FBI Director: Without Compromise on Encryption, Legislation May Be the 'Remedy' (cyberscoop.com)

An anonymous reader shares a report: FBI Director Christopher Wray said Wednesday that unless the U.S. government and private industry are able to come to a compromise on the issue of default encryption on consumer devices, legislation may be how the debate is ultimately decided. "I think there should be [room for compromise]," Wray said Wednesday night at a national security conference in Aspen, Colorado. "I don't want to characterize private conversations we're having with people in the industry. We're not there yet for sure. And if we can't get there, there may be other remedies, like legislation, that would have to come to bear." Wray described the issue of "Going Dark" because of encryption as a "significant" and "growing" problem for federal, state and local law enforcement as well as foreign law enforcement and intelligence agencies. He claims strong encryption on mobile phones keeps law enforcement from gaining access to key evidence as it relates to active criminal investigations. "People are less safe as a result of it," he said.

Comments

"People are less"

[Loon911]

More like the government institutions are less safe from the people.

Re:"People are less"

[Anonymous Coward]

Listen Sherlock!

We dont use encryption at the 3 letter agency where I work. It would just defeat the purpose of being a 3 letter agency in the first place. We simply protect the network physically duh!

I take public transit. A local bus take me down the street to pick up the express bus, the express bus drops me off in Palo Alto, and a local bus take me down the street to my job. An hour each way. Driving through Palo Alto during rush hour is insane. Since I work in government I.T., I start work at 7:00AM.
--
Dwayne Johnson's Rampage As A Kaiju ("Weird Beast") Monster Movie

Re:"People are less"

[saloomy]

This is stupid. Even if legislation came to bear, there is still open source, free and openly available encryption. The cat is out of the bag. Further more, there are phones moving across political boundaries. Are you going to mandate foreigners disable encryption when they enter the country?

Re:"People are less"

[Anonymous Coward]

The little bitch is saying "do what we want or we'll make a law forcing you to do what we want".

Christopher Wray is a weak-ass piece of shit who is trying to make a power grab. Someone ought to beat the shit out of that wimp.

Re:"People are less"

[Anonymous Coward]

People are less safe because we wear non-transparent clothes. We are less safe because are houses aren't made of glass.

Re:"People are less"

[Chas]

Sorry, but less safe than WHAT?

Sure, some people might have their safety compromised by encryption stopping law enforcement.
But how many people's safety is going to be endangered by mandating lack of encryption or that encryption violate MATH and back doors be put in "just for the good guys"? Because those back doors WILL be found and WILL be used! And not just by the "good guys". If there IS any such thing.

There is NO such thing as perfect safety. And anyone selling you that is blowing smoke up your ass. With a leaf blower.

Given the choice between freedom and safety, I'll take freedom. Thanks.

Re:"People are less"

[Anonymous Coward]

Encryption is not allowed to be exported because it's considered a munition, so if they ban it wouldn't it infringe upon second amendment rights? So if they ban encryption, they should also be ok with banning guns.

Re:"People are less"

[jpaine619]

No. The 2nd Amendment is a right enjoyed by citizens. Banning the export of any weapon doesn't affect anyone's 2nd Amendment rights... Banning the importation... well, you could make an argument there...But not the other way around

(disclaimer: I am pro 2nd amendment)

Re:"People are less"

[Anonymous Coward]

When the government fear the people, there is democracy... the other way around, there is tyranny.

20 years ago there where no phones which contained "mother-loads of evidence". Yet criminals were caught.
"Finding" this self-incriminating evidence should be banned altogether, just as you can use the 5th amendment. Anything you say to law enforcement _will_ be used against you, anything in your favor is just "hearsay" and non-admissible. Governments have no intrinsic right to know everything about you.
There are plenty of crooked politicians and corporations to keep law enforcement busy for years. They are not interested in justice, just statistics and fat pensions.

Re:"People are less"

[Anonymous Coward]

People are less safe because we wear non-transparent clothes. We are less safe because are houses aren't made of glass.

Please stop giving them ideas.

Re: "People are less"

[datavirtue]

I hope he realizes that the encryption legislation would have to make it through the house and the president....with silly valley screaming the whole way. It will cause more privacy/profit problems for bug tech....and thats the last thing they need right now. Glad he mentioned there are private talks going...that should go over well.

Re:"People are less"

[Anonymous Coward]

No.

As an example of what this means is that Apple would not be able to offer up any apps in its app store that did not comply with US government regulations. And for the sake of Apple simplifying their inventory, all phones would be made to meet the US requirements.
What about "jail breaking" of phones? Nothing can be done to stop people illegally modifying phones, any more than cars.
What about Android? Apps for Android would all need to meet the same requirements: ensure all apps used on phones comply.
Everyone, everywhere, would essentially be bound by this.
But wouldn't people in other countries object and cry out in rage?
A very small number (relatively speaking) actually care about this.
And none of those that would be outraged would be government, law enforcement, etc.
Or in other words, every government around the world would be happy with this and therefore it will see little resistance if it comes to legislation.

Re:"People are less"

[BlueStrat]

"People are less safe as a result of it," he said.

It's true. People are less safe in a free and open society.

~Safety~

~Liberty~.

Choose one.

They promise free schooling, free healthcare, free food, free housing, and work. You can get that anywhere. We call it a "prison".

What only a free and open society can provide is the opportunity to pursue whatever dream you have to the best of your ability, and leave success or failure up to you and the choices you make.

Not to mention (referring to Weay's comments) the simple fact that if governments can crack/access it, so can criminals. After all, "government" and "criminal" are synonymous in all practical sense.

Strat

Re:"People are less"

[Joce640k]

People are much less safe because we wear clothes with pockets than because we have encryption.

Clothes should be higher priority than encryption but let me guess, this particular politician likes wearing clothes. Am I right?

Land of the free, and all that.

Re:"People are less"

[Anonymous Coward]

there is still open source, free and openly available encryption.

There's a difference between "openly available encryption" and "illegal openly available encryption". Yes, the difference is legislation, and yes, it does matter.

Are you going to mandate foreigners disable encryption when they enter the country?

Of course they are. And if you cannot, for whatever reason, disable it then you phone will become illegal and will be seized by the government. Exactly as they do with may other things.

Re: "People are less"

[Anonymous Coward]

We are less safe because are houses aren't made of glass.

Given the not so gradual decline toward morbid obesity in fast food consuming nations, I feel much safer for opaque accommodation.

Re:"People are less"

[Anonymous Coward]

You know what makes people even less safe? Other people!

Re:"People are less"

[Anonymous Coward]

"What only a free and open society can provide is the opportunity" to let the best education, best ideas, best health care thrive. Unfortunately, this is now shown to be a failure, at least implemented through the constitution within the United States.

Re:"People are less"

[BlueStrat]

"What only a free and open society can provide is the opportunity" to let the best education, best ideas, best health care thrive. Unfortunately, this is now shown to be a failure, at least implemented through the constitution within the United States.

The US government hasn't been anywhere near adhering to the constitution as it was written and amended for over a century, just like there haven't been free markets in the US for nearly as long. The US has become a kleptocratic oligarchy with the trappings of a democratic republic, nothing more.

The further the US departs from the Constitution and free markets, the worse things get across the board from civil rights to the economy, foreign relations, corruption & Rule of Law, and more. Amazingly, a large percentage of people have allowed TPTB to convince them that it's the Constitution that's causing the problems, not their constant and unrelenting twisting, redefining, and outright violations of it and every election keep putting the same or same kinds of people into power over and over again.

Insanity has been defined as repeating the same actions yet expecting different results each time.

Strat

Re:"People are less"

[fatwilbur]

Looking at statements like this, combined with the FBI actions during the election that have now become public, combined with their massive intelligence failures of the past, and people are still outraged when Trump criticizes them. To me, he's the only one trying to hold them accountable to good performance and non-corruption, and if we left it up to the anti-Trumpers they'd just let the FBI do whatever they want with no oversight or accountability.

Re:"People are less"

[Anonymous Coward]

No. The 2nd Amendment is a right enjoyed by citizens. Banning the export of any weapon doesn't affect anyone's 2nd Amendment rights... Banning the importation... well, you could make an argument there...But not the other way around

(disclaimer: I am pro 2nd amendment)

I think what the other AC is saying is, that if Encryption is considered munitions, thus Arms when exporting.
Would that not make Encryption also be covered by the 2A and thus US Citizens guaranteed right to own Encryption.

One fear I would have if that argument made it to SCOTUS and was upheld as 2A covers Encryption,
would be that then the Government classifies Encryption in the NFA AOW category and thus need a tax stamp, 6 month+ background check, etc. to engage in online shopping due to HTTPS / TLS.

Re:"People are less"

[Anonymous Coward]

" there is still open source, free and openly available encryption" unless of coarse it is made illegal to deploy or use a legally non compliant encryption device. In which case you can get life for having or owning one and they don't need to worry about convicting you of whatever it is you might want to hide.

Re:"People are less"

[Opportunist]

Have you considered the impact on your economy? Why, tell me, should I store my data in your insecure country? Why should I do business in your country when I have to pretty much assume that anyone can intercept my communication? Furthermore, how easy do you intentionally make it for foreign competitors to spy on sensitive data and communication of your companies?

And that's just the tip of the ice berg.

You are crippling your economy in this time and age if you disallow encryption. Communication via the internet cannot be beat in terms of speed and price. Yes, it is possible to establish mostly secure communication without opening your communication to eavesdropping, but the cost alone would ruin your chance to be competitive internationally.

If you think the Chinese are stealing your trade secrets now already that you CAN encrypt, you ain't seen nothing yet.

Re:"People are less"

[Opportunist]

You're free to do as we tell you. And if I don't need it, neither do you.

Re:"People are less"

[Anonymous Coward]

They abused their power, and now they are losing it... and crying like two year olds the whole way.

Re:"People are less"

[Anonymous Coward]

The US government hasn't been anywhere near adhering to the constitution as it was written and amended for over a century, just like there haven't been free markets in the US for nearly as long. The US has become a kleptocratic oligarchy with the trappings of a democratic republic, nothing more.

You say that like it's a bad thing.

Historically, kleptocratic oligarchy is the most stable form of government. It sits between extremes of tyranny by minority (dictatorship) and tyranny by majority (mob rule)

Now, democratic Republics could be like that too, but history shows they are less stable. Roman Republic didn't last as long as Roman Empire. The French tried to form a republic after seeing America do it, but they had to go through 4 different tries before arriving at their current one, and conservative types like you are saying they (along with the EU) won't last what with all them refugees and would not.

And like you said, even the American one didn't last. I'd even argue that the US has ceased to be a democratic republic for longer than it existed as one (I date the switch to the Civil War)

The further the US departs from the Constitution and free markets, the worse things get across the board from civil rights to the economy, foreign relations, corruption & Rule of Law, and more.

That's not supported by history. Again, the switch started as far back as the Civil War, and America has been on an overall rise since then.

Insanity has been defined as repeating the same actions yet expecting different results each time.

I don't think people are expecting a different result though.

I think people are choosing to repeat the same actions because they WANT those same results. They want their oligarchies hegemonies, as they believe they benefit from it (maybe they think they're part of the oligarchs, or maybe they think their oligarchs are benevolent masters who'll treat them right)

Re:"People are less"

[JesseMcDonald]

Banning the export of any weapon doesn't affect anyone's 2nd Amendment rights

Human beings, not just American citizens, possess the natural rights of property and self-defense, which includes the right to keep and bear arms. While the 2nd Amendment per se may only apply within the US—because the Constitution itself only has jurisdiction over the US federal and state governments—the "2nd Amendment right" to keep and bear arms has a much wider scope.

All of which is immaterial, since it isn't the right of non-citizens to keep and bear arms which is infringed by banning weapon exports, but rather the right of American citizens to peaceably use and dispose of their own private property, including weapons, as they please, which—while not expressly codified in any Amendment—is far more fundamental to a free society. The 2nd Amendment only (directly) says that the government cannot prohibit the possession of weapons; it doesn't say anything about the right to manufacture or trade them, whether between citizens or across borders. This most fundamental of rights was simply taken for granted. Of course, the government was never empowered to interfere with the manufacture or trade of any kind of good to begin with, but it wouldn't have hurt to make this explicit in the Bill of Rights. The founders, unfortunately, were a bit too optimistic about the good nature (and sense) of those who would come after them.

Re: "People are less"

[Anonymous Coward]

With your smartphone, google, alexa, and smart devices, you do live in a glass house.

Re: "People are less"

[Anonymous Coward]

Which 'they' do you mean? It's ambiguous, which is a worthwhile point to make from the middle.

Re: "People are less"

[Anonymous Coward]

Ok, Adolph. Whatever you say.

Re:"People are less"

[Actually, I do RTFA]

20 years ago there where no phones which contained "mother-loads of evidence". Yet criminals were caught.

While true, it's a lie to claim that encryption just keeps thing as they were 20 years ago. 20 years ago, written plans could be found and phone calls tapped. Now, those are likely to be encrypted.

Re:"People are less"

[Shotgun]

No. Christopher Way is a very powerful administrator trying to make a power grab (because, a little more is never enough).

Re: "People are less"

[Anonymous Coward]

I hope he realizes that the encryption legislation would have to make it through the house and the president....with silly valley screaming the whole way. It will cause more privacy/profit problems for bug tech....and thats the last thing they need right now. Glad he mentioned there are private talks going...that should go over well.

Given the great big middle finger that silly valley has given to Trump, I think he would be happy to sign anything that dropkicks them in the nards.

Re:"People are less"

[Agripa]

There's a difference between "openly available encryption" and "illegal openly available encryption". Yes, the difference is legislation, and yes, it does matter.

I think legislation is a great idea. The sooner users are compiling from 1st amendment protected source code, the better.

Re:"People are less"

[Anonymous Coward]

This is stupid. Even if legislation came to bear, there is still open source, free and openly available encryption. The cat is out of the bag.

Sheesh. And I thought that the FBI fellow was out of touch with reality. You take the cake.

It doesn't matter if the technology is easily available if the mere possession of it is illegal.

Re:"People are less"

[Anonymous Coward]

> Are you going to mandate foreigners disable encryption when they enter the country?

They already do, effectively. If a border agent asks you to enter the password to your phone and your email and facebook account - and you refuse - you're not allowed entry to the US.

A year ago a Canadian after being refused entry based on what was on his phone (he was gay and headed to New Orleans for Mardi Gras) was flat out told - "don't you dare show up at border control with a brand new empty phone, or we'll ban you for life".

Re:"People are less"

[Anonymous Coward]

I piss on your false dichotomy that we cannot makes basic requirements to succeed in society a service provided to all without also signing away the right to privacy. The issues are disjoint. You know they are disjoint.

Rather than choosing "no social services and privacy" or "social services and no privacy", one may certainly choose "social services and privacy" as a political platform. In fact, in many totalitarian regimes, people are also capable of recieving "no social services and no privacy", another alternative you neglected.

Re:"People are less"

[Anonymous Coward]

Is there *anything* you swivel-eyed rightards won't try to spin into "socialism=communism=evil"? Conservatism needs to be treated as a mental illness; then, perhaps, we can move forward as a species.

how many times does this have to be debunked?

[Anonymous Coward]

This guy sounds like one of those out of touch eurotrash politicians. STFU and be better at your job asshat.

Re: how many times does this have to be debunked?

[Anonymous Coward]

European is not a race

Re:how many times does this have to be debunked?

[Aighearach]

He might just be admitting that if they can't convince the companies to do what they want, Congress will have to pass a law ordering them to stop trying, which will totally solve the problem.

He's not in Congress, he's in the Executive Branch, so there is no reason to think that he thinks he'd be choosing which type of legislation is needed to fix the problem. And anyways, according to the Constitution there might be only one direction that Congress can even move to settle it! They're certainly not going to pass a law telling us what content can be produced on a press.

Re:how many times does this have to be debunked?

[Narcocide]

Your sarcasm is too subtle here. People are going to miss it.

Re:how many times does this have to be debunked?

[Anonymous Coward]

This guy sounds like one of those out of touch eurotrash politicians. STFU and be better at your job asshat.

try again without the racism.

Sorry about that, I'll fix that for you.

This guy sounds like one of those out of touch eurotrash politicians. STFU and be better at your job numbskulls.

Re:how many times does this have to be debunked?

[jpaine619]

Seriously?

When did "European" become a race?

Re:how many times does this have to be debunked?

[aticus.finch]

Seriously?

When did "European" become a race?

Just after "muslim" became a race. The slippery slope in action.

Re: how many times does this have to be debunked?

[datavirtue]

Muslim isn't a race? ....off to wikipedia.

Re: how many times does this have to be debunked?

[Anonymous Coward]

That's formally true, the correct term would be Chauvinism, but that has been re-appropriated as well. In practice your comment is bullshit, of course, because the term "racism" has been re-appropriated to a broader meaning a long time ago.

Re:how many times does this have to be debunked?

[butzwonker]

There are no phenotypical races anyway.

Re:how many times does this have to be debunked?

[scarboni888]

I didn't read it as sarcasm so much as a call to action. Call your congress-critters, people and tell them backdoors are unacceptable on any terms.

Re:how many times does this have to be debunked?

[Opportunist]

Huh? We don't put goofballs like that in positions of power, where does that hyperbole come from?

Re: how many times does this have to be debunked?

[Anonymous Coward]

Jewish isn't a race? So *that's* why it's called "antisemitism" instead of "racism". Makes sense!

Re:how many times does this have to be debunked?

[Aighearach]

Sarcasm is a crutch for weak minded people with little to say and no idea how to say it.

My words were my words, and your words were not.

Re:how many times does this have to be debunked?

[Aighearach]

Neither. I meant what I said, and I said what I meant.

It was analysis. No, it was not comedy or politics.

But certainly if a person considers the ideas expressed to call them to action, more power to them! Or less, if they screw up the PR. Not my thing; but I'll be happy to offer some analysis if they manage to have some impact.

Re: how many times does this have to be debunked?

[Anonymous Coward]

It's easier to hate european and other "white" races when you pretend they're all the same and have no diversity.

Imagine if people woke up and realized that white is the most diverse colour in the world by far....It would undermine their ability to racially criticize

So either way..... we don't have privacy.

[Puls4r]

Either private companies give up our privacy by allowing the government access to our communications...... or laws will be passed FORCING them to give up our privacy.

And we wonder why the United States Government won't pass a law protecting our personal data.

Re:So either way..... we don't have privacy.

[mrclmn]

Compromise is an interesting word choice. Indeed everything will be compromised.

Re:So either way..... we don't have privacy.

[Narcocide]

as if it weren't already

Re:So either way..... we don't have privacy.

[youngone]

I'm not sure that's really what the FBI want.
It may be that they just want a law that they can use to charge people even if they have no real evidence of any other crimes, like the "Lying to the FBI" laws.

Re:So either way..... we don't have privacy.

[Anonymous Coward]

Accessing the private communications of the citizens is a use of force against them, that is wiretapping or a search. Use of force should always be either legislated, or not done at all. Private companies should not use force against the citizens unless it's a trivial matter like giving notices for illegal parking, or for a legitimate legal reason like protecting property or life they are responsible for. Then the US government can pass all the privacy laws they want since they are on a solid ground and the issues have been dealt with by going through the legislative process. Finally.

Re:So either way..... we don't have privacy.

[AHuxley]

The phone and any devices in a dwelling will be used to collect it all.
The level of encryption US brands had the staff to work on is not of good quality.
So the FBI can get into it all as it always did.

The legal side is the real question for the FBI.
Collect it all and then never tell lawyers, press, other police, experts?
That fully protects FBI crypto methods from human rights lawyers, political activist media, cults, faith groups, police who give information to criminals, gov/mil staff with a split loyalty to the USA.
The down side is the risk then needed to create another way to start an investigation. To get a plea bargain, create an informant.

The other way is to go full NSA and DEA. Let the USA know everyone is getting collected on domestically and with public/private partnerships.
Two very different methods that have the US gov totally in all communications.
One will see a person confronted with their cell phone use.
Another method will see full parallel construction, the use of informants to hide the collect it all US crypto ability.

A huge internal struggle in the FBI. To collect and collect on every hop of communications for years and always win.
To get human rights lawyers looking over sensitive US domestic collection methods, collection results and ensuring such methods are talked about.

Does the FBI want to be as skilled as the GCHQ was at keeping methods hidden for decades? Total winning but nobody will ever know.
Have key evidence and active criminal investigation methods sold and given away by lawyers, cult members, criminals, police working with criminals?
To have US ISP and big brand staff know how the FBI breaks crypto and sell such methods to criminals, other nations?
To have police and city workers under watch by any criminal groups, cults able to buy the same crypto collection methods?
Once junk US crypto is broken for police, everyone interesting can afford a key.

Re:So either way..... we don't have privacy.

[Antique Geekmeister]

I'm afraid that many companies already do so, as a matter of course. Cisco has become infamous for the backdoors embedded in their hardware. The "Clipper Chip" of the 1990's was an attempt to do exactly this at a hardware level, and was discarded only when it was discovered that the "law enforcement agency field" checksum too short and people could generate their own, genuinely private keys without direct detection. The newer "Trusted Computing" technology for individual host encryption and software was designed to put all the signature keys, and the signature keys used to authenticate or obsolete other keys, are in Microsoft's private hands in an "escrow" which has no legal protection and which Microsoft has never acknowledged any binding standard of privacy for.

Re:So either way..... we don't have privacy.

[Anonymous Coward]

Actually, I'm supprised the US hasn't done away with the idea of "justice" altogether.

The FBI clowns would be better served with a law that says "The FBI reserves the right to jail you at any time they feel like it, any objections are subject to a mandatory death penalty." At least then they wouldn't need to go around pretending to care about the citizenry.

Honestly, I'm supprised this law isn't already on the books with the last few presidents approving of torture as an interrogation method. Though, I suspect they would still engage in torture even with such a law on the books....

Re: So either way..... we don't have privacy.

[datavirtue]

Found the Russian

Re: So either way..... we don't have privacy.

[Anonymous Coward]

Found the totalitarian.

Re:So either way..... we don't have privacy.

[DivineKnight]

Because they've shown that they can't. The DoD can't keep plans for its next gen weapon systems out of enemy hands, and our government writ large has the retaining capacity of a sieve with regards to general data.

For God's sake, they can't even keep the coke from disappearing from the evidence locker.

Re: So either way..... we don't have privacy.

[nnet]

But you couldn't find Waldo...

Re: So either way..... we don't have privacy.

[Anonymous Coward]

You know that people laugh at you every time you post such things, right?

TIL that the media talking about Gitmo during Bush were all Russian for making the FBI look bad. Good thing Obama closed it! Err, wait. What do you mean he forgot about it?

Re: So either way..... we don't have privacy.

[Anonymous Coward]

in your mirror?

Bend the americans over

[Anonymous Coward]

Many backdoors to pound on until hacked.

FBI and CIA fools should be fired for such stupid requests.

Re:Bend the americans over

[Anonymous Coward]

They asked to get ass-fucked when they voted for small=hand cheeto hitler.

#Resist!

Re:Bend the americans over

[Anonymous Coward]

ROFL! Good luck with that!
--
Dwayne Johnson's Rampage As A Kaiju ("Weird Beast") Monster Movie

Re:Bend the americans over

[Pinky's Brain]

Why would a locked backdoor change anything when there's already a frontdoor with the same quality lock? Apple&co can just push an update to your phone to own your phone if they want ...

Legislation can't stop open source

[xaosflux]

When encryption is outlawed, only outlaws will

-----BEGIN GPG MESSAGE-----
Charset: utf-8

qANQR1DDDQQJAwKQIuGxR9ku8L/SQgH6kXzdtVHv9IwDWcZVsGX5G2UZje9L8VoC
Y6faoCNMAg+Zq8S92arz+DV/yEsZo3jBoCFZBsOPqXOO8ATiMmoSQA==
=7Ce4
-----END GPG MESSAGE-----

Re:Legislation can't stop open source

[Anonymous Coward]

Actually it can. The solution: give us the key or go to jail. Or even better, give us the key or we'll hit you with this $5 wrench. https://xkcd.com/538/

Re:Legislation can't stop open source

[Anonymous Coward]

Problem with "give us the key or go to jail" is...what if you don't have the key?

What's to stop someone sending me some encrypted communication with a public key that I don't have access to?

Re:Legislation can't stop open source

[Graymalkin]

Drink your ovaltine?

Son of a bitch!

Re:Legislation can't stop open source

[Hallux-F-Sinister]

When encryption is outlawed, only outlaws will -----BEGIN GPG MESSAGE----- Charset: utf-8 qANQR1DDDQQJAwKQIuGxR9ku8L/SQgH6kXzdtVHv9IwDWcZVsGX5G2UZje9L8VoC Y6faoCNMAg+Zq8S92arz+DV/yEsZo3jBoCFZBsOPqXOO8ATiMmoSQA== =7Ce4 -----END GPG MESSAGE-----

Stop in the name of the law! I can't read every word you wrote, therefore I'm scared of it and deeply suspicious of both it and of you, even though your message was not written to me, and it's none of my business, I think I should be able to read any and everything written anywhere, anytime, by anyone, without having to show cause for why I should be allowed to do it.

~ The US government.

Re:Legislation can't stop open source

[youngone]

There's nothing to stop you doing just that A/C, just like there will be nothing stopping the FBI charging you with using unlawful encryption if you do.
Your choice.

Re:Legislation can't stop open source

[Anonymous Coward]

Fuck you, go to jail.

https://www.miamiherald.com/news/state/florida/article214948205.html

Re:Legislation can't stop open source

[Altus]

You say this like its a bug and not a feature

Re:Legislation can't stop open source

[Anonymous Coward]

Dude get real, they'd have to make written language illegal.

Re:Legislation can't stop open source

[cfalcon]

> Dude get real, they'd have to make written language illegal.

Shh, don't give them ideas!

Re:Legislation can't stop open source

[Anonymous Coward]

Problem with "give us the key or go to jail" is...what if you don't have the key?

Or what if there is no key? Properly encrypted communication should be indistinguishable from random gibberish.

Or what if you give them the key, but upon finding nothing incriminating they ask for the "real" key thinking you are using a hidden volume?

Or what if they think one of your innocuous images contains a hidden message via steganography?

Re:Legislation can't stop open source

[novakyu]

That's why steganography exists. Don't make it obvious you have something to protect, unless you have a literal stronghold to actually protect it with.

P.S. BTW, I assume you meant to say "with a public key associated with a private key that I don't have access to?", because I am generous. The way you prevent that from happening is you revoke your public key once you don't have access to your private key. (And the way you do that is by generating revocation certificate and keep it somewhere safe before you lost access to your private key.)

Re:Legislation can't stop open source

[Anonymous Coward]

The solution to that problem is stenography. Encryption? What encryption? All I have is the photo of the Mona Lisa that happens to be slightly larger than normal. I can't be held responsible for knowing that there might be something hidden inside.

https://en.wikipedia.org/wiki/Steganography

Re:Legislation can't stop open source

[Anonymous Coward]

quote> ... the passcode combination was sought only for its content and would not require the owner acknowledge that the phone contained evidence of a crime...

Translation: We want your data, not a confession.

Reality: It's a search; in this case of his associates in drug consumption.

Re:Legislation can't stop open source

[Anonymous Coward]

What? They aren't after the public key. Per definition that is public, not something YOU have. What they are after is the PRIVATE key and want you to give up that one. And if you don't have the private key, well, then no one is communicating with you since you cannot read the garbage that is being sent your way.

Re:Legislation can't stop open source

[Anonymous Coward]

but if you do not have the revocation certificate?

lets assume Alice is an upstanding citizen that is privacy aware and has set up a public private keypair for her email address.
further she is politically active in the "raisins should be a choice!" initiative because she does not like raisins in her food and wants regulation to reduce the influence of the raisin industrial complex on the food industrie.

now Eve comes into the picture.
Eve loves raisins, thinks all food should contain raisins and supports the "raisins everywhere!" movement.
Eve is a little tech savvie and decides to take Alice out of the picture.
Eve creates a sock puppet spouting anti raisin propaganda and also indicating criminal activity.
Eve creates a new private/public keypair for Alices email address and starts to send encrypted email from the sock puppet to Alice.

Finally the police or any governmental organization decides that Eves sock puppet did something horrible enough to bring up charges against the sock puppet.
However Eve was wise enough to hide her tracks and they can not find the real identity of the sock puppet.
But they notice that the sock puppet regularly sent encrypted email to Alice.
They have to work together, so they arrest Alice and demand she decrypt the messages.

Alice can not because she never had control of either the private key or the revocation certificate.
Alice goes to jail and the "raisins everywhere!" movement prevails.

Re:Legislation can't stop open source

[Bob the Super Hamste]

Steganography shoudln't change the image size unless the program is really dumb or it increases the entropy of the image making compression less effective. Most of the time it operates by changing the low order bits in an image file. The hidden data basically hides in the noise in the image and to help obfuscate its existence it usually encrypted. By packing too much data into an image you may end up introducing substantally more noise, so if one really wanted to hide a lot of data in an image file I would crank up the ISO to at least 6400 and go even higher to 12,800, 25,600 or more depending on the camera as even the best digitals now have a lot of noise at those ISOs. Also 16 bpc tiffs have a lot of low order bits to play with.

If anyone wants to play around with steganography the program openpuff is a good place to start. Sorry I don't have a link as it is blocked at work.

Re:Legislation can't stop open source

[butzwonker]

Steganography is easy to detect if you know the statistical properties of the carrier channel and have access to sufficient amounts of data from it.

Re:Legislation can't stop open source

[drinkypoo]

Any legislation which makes crypto back doors mandatory will almost certainly make steganographic tools illegal. Just having them will not only be a crime, but a de facto admission that you have something to hide.

Re:Legislation can't stop open source

[Anonymous Coward]

I think there was already a court case where "give us the key or else" was found to violate the 5th IFF the accused hadn't yet admitted ownership of the device. That is, it was considered a compelled confession that the device was theirs.

Re:Legislation can't stop open source

[Anonymous Coward]

o;hgda arheogahaore hgrehahopre aeprohzbvh arughdbf.

Now, decrypt that for the FBI.

What's that? You don't have the key? You don't even know if that is encrypted text and not just gibberish? Well too bad, according to your logic you should have simply chosen to not receive this message.

Re:Legislation can't stop open source

[Anonymous Coward]

Steganography just means that, when they find nothing incriminating, they can claim that you haven't given them everything, and then the beatings continue indefinitely because you cannot prove there isn't something still hidden.

True, it shouldn't work that way, but of course it will.

Re:Legislation can't stop open source

[novakyu]

I admit steganography will never be "unbreakable" as strong encryption (OTP, if quantum computers become a reality and asymmetric ciphers become breakable) can be. It's the difference between stealth and impregnable fortress—a fortress you can actually make impregnable; with stealth, you do your best and hope that your enemy doesn't notice you were there.

I personally prefer the probable safety of stealth over the definite likelihood of impregnable fortress attracting attention.

Re:Legislation can't stop open source

[novakyu]

I stopped reading after "but if you do not have the revocation certificate?". It's like asking "what do I do in a car accident if I do not have an auto insurance?"

Why, simple; you invent a time machine, go back in time, and make sure you have done this one, low-cost prudent thing that you ought to have done.

Re:Legislation can't stop open source

[Anonymous Coward]

Any good system should have two types of password protection.
The one I use when I want in.
the one I give out if someone forces it out of me ( that is the one that auto deletes all data of certain types or destroys the device outright while wiping all keys).

That way when someone ask you for the password, they need to ask themselves if they really want to put it in.

Re:Legislation can't stop open source

[Opportunist]

What encryption? All I see is a beautiful picture of a flower.

You outlaw encryption, I start using steganography. And what you call encrypted data is just random noise, sorry. Want to see my pictures from the trip to Niagara Falls? I have 500 pictures of the falls alone, a MUST see!

Re:Legislation can't stop open source

[Opportunist]

Even that's no longer true. All it takes is the correct kind of picture that has potentially lots of random noise and you're golden.

You might want to hang on to that 2mpix-potato you used to shoot pics 20 years ago...

Re:Legislation can't stop open source

[Opportunist]

What tools? Oh, that thumb drive? I wiped that a while ago, right now it's empty.

Re:Legislation can't stop open source

[Anonymous Coward]

you are assuming a lack of malice on the part of the sender.

Re: Legislation can't stop open source

[Anonymous Coward]

They will enter the password, and then, when it wipes the image they made first, they will upgrade you to the $10 wrench and try again.

Re:Legislation can't stop open source

[Anonymous Coward]

ok if you are not capable to read, here is the tldr:

you not create keys -> you no revocation certificate.

it can be used to railroad someone.

that was also the point of the previous poster.

Re:Legislation can't stop open source

[shutdown -p now]

There are ways to detect encrypted payloads in such cases. And they don't need to make a foolproof case of it. They just need to sound convincing enough to the judge, and then you just get slapped with contempt of court.

Re:Legislation can't stop open source

[novakyu]

Previous poster who didn't understand how public-key encryption worked. When you just find a random public key on a key server, you are not supposed to trust that it belongs to the person that it claims to. Only when the public key is signed by enough trusted people, the key can be assigned to someone (read: web of trust).

For a key that can be assigned to you this way, you definitely had access to the private key at some point, and you ought to have generated a revocation certificate at that time.

If your point is government agents are stupid and they won't do the due diligence to check if the key actually belongs to you, well, you don't need to bring in cryptography to make an argument based on the fact that governments are run by stupid people.

Re:Legislation can't stop open source

[RespekMyAthorati]

Oh yeah? Then it's off to jail for you, opportunist.

Re:Legislation can't stop open source

[Opportunist]

For what? For not having incriminating evidence on me?

Re:Legislation can't stop open source

[Anonymous Coward]

while the web of trust is useful in general, it is not necessary.

it is sufficient to know the public key of the persons involved in communication.
you can exchange those kees personally, no need to sign anything.

the web of trust is only useful for verifying persons you do not know in person/had the chance to verify their public key with other means.

its perfectly legitimate usage to use not signed keys with people you had the chance to exchange them in person.

therefore it would not be stupid of police to assume the key may still belong to you, even if it is not signed.

yes, the police can harass you with other means aswell, but allowing to jail someone for not decrypting something is an additional tool that can also be easily abused by common people.

Re:Legislation can't stop open source

[novakyu]

Make up your mind (assuming I'm arguing with the same AC). Does the existence of a public key mean you have the private key or not?

Either such assumption is an idiotic (and dangerous) one to make, meaning the police really ought to apply at least some aspect of web of trust (or if not the official web of trust, some level of due diligence, ruling out the exact scenario you were concocting), or such an assumption is a valid one, meaning you have no excuse when someone sends you an encrypted message using "your" public key.

My position has been consistently the former; yours seems to change at the moment's convenience.

Re:Legislation can't stop open source

[Anonymous Coward]

First 2 AC posts since root are not mine, rest is.

My position in short is:
A key can be linked to an email address without the owner of the email address creating it.
It is still a legitimate assumption from the police that the key belongs to the owner of the email address.

That is how policing works in most modern states.
They need probable cause to investigate further into someone.
That probable cause can be a description of a person or anything that hints at the identity of a person.

My solution for balancing the rights of an individual vs. the power given to police to catch a criminal in this scenario is not to allow the justice system to jail you for not providing a password.

Yes, they can still argue "probable cause" and do things that interfere with your life but at least its not the second highest punishment the US justice system can use against individuals.

Re:Legislation can't stop open source

[novakyu]

Then we simply have a fundamental disagreement. A public key listing an email address without any backing evidence (i.e. signatures from trusted keys) has no more claim that it was created by the person who controls the email address than a spam email with a spoofed "From:" header does.

So, from my position, any hypothetical involving these is as ridiculous as a person freaking out about prosecution on, I don't know, child porn charges, because it is possible for a malicious person to send child porn to your local DA while spoofing your email address.

In an ideal world, the DA is smart enough to do an actual investigative work to realize the "From:" header has been spoofed (so this is stupid thing to worry about); in a stupid world, the DA is already dumb enough to be duped by something like this, so criminalization of "failure to provide decryption key" doesn't add any more legal jeopardy to someone who is unfortunate enough to be a target of a malicious actor.

Anyways. This is a fundamental disagreement (you are not going to see my point of view; last few exchanges have proven that; I consider myself smart enough not to agree to your position), so I'll leave it here. We are at an impasse; I'm not going to convince you; you are not going to convince me.

Re:Legislation can't stop open source

[Anonymous Coward]

has no more claim that it was created by the person who controls the email address than a spam email with a spoofed "From:" header does.

Thats a fair point.

I would assume, that the DA would actually raid the home of the owner of the email and confiscate all storage found there in any case. When they find encrypted stuff, they would demand decryption and you would go to jail if you do not decrypt.

I agree to disagree :-)

Re:Legislation can't stop open source

[novakyu]

Agreed.

Also

[TsuruchiBrian]

If the private sector does not recognize 3.2 as the true value of Pi, then legislation may be the only remedy.

Re:Also

[Rick Schumann]

Your information is out of date. Much more recently (less than 10 years ago?) some state legislature tried to make Pi equal to 3. That's the sort of fucktardedness we're dealing with anymore.

Re:Also

[CrimsonAvenger]

Much more recently (less than 10 years ago?) some state legislature tried to make Pi equal to 3.

If this is the same incident I read about at the time, it actually made pi == 9....

Re:Also

[arth1]

If this is the same incident I read about at the time, it actually made pi == 9....

Well, that sure puts an end to speculations about the curvature of the universe. Omega must be less than one.

Re:Also

[pslytely psycho]

It was Indiana and a bit more than ten years. It was proposed by Indiana physician and amateur mathematician Dr. Edwin J. Goodwin, Bill #246.....in 1897. It became known as the Indiana Pi Bill.

I had never heard of this, so this thread got me curious.

https://en.wikipedia.org/wiki/Indiana_Pi_Bill

Re:Also

[Anonymous Coward]

https://www.snopes.com/fact-check/alabamas-slice-of-pi/

Re:Also

[Rick Schumann]

No, I distinctly remember some other state much more recent than the 19th century trying to do this, and it was exactly 3 they wanted to make 'official'.

Re:Also

[Rick Schumann]

..okay, then I distinctly remember a news story about this hoax of an April Fool's joke. xD xD xD All in all it's a sad commentary on how I view my fellow 'humans' that I'd believe a state legislature would actually do this for real. :-(

Re:Also

[pslytely psycho]

As far as I can tell, other than a few hoaxes about Alabama and Kentucky, this is the only instance of such a bill actually being crafted.
However, It wouldn't greatly surprise me to find this has been proposed as part of some 'education bill' or such.

As far as memory goes, I distinctly remember being 19 last week, how I woke up in a 59 year old body is a complete mystery to me!
(;

settled

[Anonymous Coward]

The issue is settled: encryption is here. By talking about it, this guy is trying to unsettle it. But he doesn't have the lobbyist power that Tim Cook has, and no one likes him anyway.

Re: settled

[Anonymous Coward]

No one likes or trusts the FBI and now they want the ability to invade our privacy. Fuck them. Trump was elected for a reason and better continue kicking them in the balls.

Re: settled

[Immerman]

Correction - they want the ability to illegally invade our privacy *back* - they've been invading it at will for many decades, and for the last couple decades have been doing it at a scale and invasiveness to dwarf anything ever before seen in all but the most dystopian fantasies. The rise of encryption has been a direct response to that unbridled power grab, and now they're trying to cast off those unwelcome limits on their unsupervised power. I mean hell, when they flat out lie to Congress about their activities, repeatedly, you've got to realize that they are no longer in any way a legitimate government agency.

Re: settled

[datavirtue]

CIA also got caught spying on the senate. Lied about it after getting called out... Vice did a FOIA request and some patriot sent them the apology letter that was drafted to the senate but was never sent. They stuck by the lie til the end.

Re: settled

[Shotgun]

And yet, all those panties got in a wad, because Trump said he took Putin at his word vs all those spy/intelligence agencies.

Re: settled

[Immerman]

Perhaps because Putin's government makes out own deeply corrupt intelligence agencies look like lilly-white pillars of virtue in comparison. Russia is basically run like a mafia after all, and there is no honor among thieves.

Nope

[Artem S. Tashkinov]

room for compromise

Math doesn't have it. If there's a shared key to all our communications, it will sooner or later leak and it will render all encrypted data wide open. Also, I presume that for some reasons Christopher Wray doesn't keep a copy of the keys to his house at some government agency, no?

People are less safe as a result of it,

Governments and often unrelated companies are less privy to our private lives as a result of it. FTFY.

Re:Nope

[Anonymous Coward]

FBI Dimwit Christopher Wray: "I'll have you know that I am admiral and my ship has the right of way!"

Math: "I am a lighthouse..."

Re:Nope

[weilawei]

Brilliant.

Re:Nope

[Pinky's Brain]

That's not necessarily what he is asking. What the FBI asked Apple originally to do is provide them the service of unlocking the phone, the FBI didn't even demand the technology to allow them to do it themselves. They just wanted Apple to do it on, with a court order.

Apple having a key to unlock your phone doesn't fundamentally cause any more of a security hole than them having keys to sign updates and to authenticate their update servers, because pretty much everyone accepts updates. If their existing keys are compromised and someone pushes a rootkit update you'll have no security either, you obviously trust Apple to safeguard those keys. Why wouldn't you trust them with one more?

Re:Nope

[Anonymous Coward]

People will be even less safe when their phones are basically open doors inviting any criminal to walk right in.

Which is exactly what will happen if the government gets its mandatory backdoor.

Re:Nope

[Anonymous Coward]

Apple having a key to unlock your phone doesn't fundamentally cause any more of a security hole than them having keys to sign updates and to authenticate their update servers, because pretty much everyone accepts updates.

No, one requires you to download and update the phone, the other allows you to pull information off your phone without altering it in any way. So if the keys/tools for the latter leaks (and they will sooner or later) you are in a whole other world of hurt.

If their existing keys are compromised and someone pushes a rootkit update you'll have no security either, you obviously trust Apple to safeguard those keys.

It is not enough to just compromise those keys. You then have to have access to the source code of the parts of the OS (or write a clone from scratch) that has the malicious code in it. Then you have to access the infrastructure needed for upgrading. A lot more steps to achieve what you are after. And then you would target ALL the users at the same time, increasing the chance of the breach to be public exponentially.

Why wouldn't you trust them with one more?

One is needed for the device to work properly, we do not longer accept a piece of hardware to not be updated after purchase. Or rather, those of us that do won't update anyway. Sure, there is a small risk that this update channel could be use to harm me, but as I pointed out, there are multiple steps to achieve this.

The other serves me as a user nothing. It only opens up a possibility for someone to access my private data without my permission. It *might* make me as a citizen a tiny bit safer. But that *might* is a theoretical might. I for once am half a globe away from San Bernadino, so my safety was never in question. But my privacy and integrity is with suggestions like these.

Re:Nope

[Anonymous Coward]

you win the internets today

Re:Nope

[Anonymous Coward]

People who fail to learn from history are doomed to repeat it.

Re:Nope

[Anonymous Coward]

Woah, there, Pinky's Brain! Your argument does not compute.

1). Apple is not an arm of the US government. "Just" asking Apple to do this work is asking Apple to act as an agent of the government. Apple isn't paid to do such work and that's just the tip of the proverbial iceberg of why they should not (i.e. paying Apple would not neatly resolve this matter);
2). There is a language problem here and the FBI attempts to leverage it (or is merely sloppy in using it). Yes, it starts with the FBI "asking", but as soon as they get a Yes, the FBI will shortly begin issuing "orders" for all subsequent device unlocks. There's no "asking" pertaining to the Three Letter Agency long game;
3). You seem to think that a key to enable software updates is the same as a key to investigate user data. You have a massive logic problem there connected to what the user perceives as "valuable, sensitive, and requiring protective security";
4). You are trying to employ mathematical logic concepts in an arena where they do not apply. In your argument, Apple = Trusted, Apple's Actions = Trusted, Gov't. Court Order = Trusted, Apple Executing Court Order = Trusted. I could take issue with any single one of those statements, but I'll only make one point for now. Trust is not an absolute binary condition, nor even is lack of trust. If my idiot nephew is an immature screw-up, I won't trust him with the bank account containing my next month's rent. However I might well trust him with $5 to go get milk from the store.

Before you go making assumptions about who I trust, what I trust them with, and why, maybe don't. I get to make that choice and not you. It's pretty clear that your way I'd wind up ceding all kinds of authority to people I don't trust, concerning the matters at play here.

Re:Nope

[Pinky's Brain]

If you own an iPhone and accept updates I know exactly the extent you trust Apple, you trust them with all the data stored on and communicated with your phone. You know they can own your device arbitrarily. In fact if government waltzes in with a national security letter, they'll have little recourse but to push compromised system/app updates your way.

My main point is that the unlock key is not some huge security hole, it's the 5$ ... the integrity of updates for which you put all your trust in Apple already is next month's rent. An over the air attack is more dangerous than a physical one.

Re:Nope

[Anonymous Coward]

Wow, you still aren't getting it are you?

"... you trust them with all the data stored on ..."

No. Nope. 100% wrong. A user that allows iPhone updates only trusts Apple to:

1). Not delete, modify, or otherwise interfere with their data;
2). Not read/snoop/datamine such data.

You are making a technical argument about what Apple could do with their access. I'm talking about what Apple actually does, and what the user expects them to do and not do. There is a difference you know.

And you know how Apple gets user trust? By sticking close to what the customers expect, by being responsible, and by not reading/snooping/datamining, when the customers don't want that.

Just because the technology doesn't have technical controls to permit/prohibit certain types of behavior, does not mean that objectionable behaviors somehow become acceptable. That's the mistake you are making. You need to stop making that mistake.

Re:Nope

[Pinky's Brain]

Semantic games, trusting them with your data is no different than trusting them not to read it. It's implicit.

All this nothing about the fact that putting another PKI guarded access in the phone doesn't magically open some random security hole which third parties can abuse ... it just means you have to trust government as well as Apple. Not even with safekeeping of the keys, just with not requesting access without good cause. Which was as I said my main point, the people who pretend this is some huge security hole are being disingenuous or stupid.

How did they ever solve a case

[RhettLivingston]

before smartphones came along? Why do they not get that the people don't want them to be able to utilize new technology to make solving crimes any easier than before?

Everyone is guilty of something. The only way the system works is if the balance between cost of prosecution and magnitude of the crime worth prosecuting remains stable (or given that we already incarcerate far more than most, shifts a bit in favor of crime). If prosecution becomes cheaper and easier, we can quickly become a police state without changing any laws.

Re: How did they ever solve a case

[tinkerghost]

Before smart phones, your entire life wasn't on a single, easy to read device - a device that happens to keep things you delete so that even years later that document you deleted can often be retrieved - not something that could happen with that letter you shredded and tossed in the trash a year ago.

Re:How did they ever solve a case

[AHuxley]

Re "before smartphones came along? "
Depends on the crime. The city and state police had a really good crime solution rate until the 1960's.
Then the USA was flooded with crime. Drugs, cash and other factors changed many parts of US culture.
The FBI did try to help communities.

Have a bank robbery problem? Talk to all bank staff and get them to notice strangers. Have a system ready to get more evidence when a bank was getting looked over and then later what to during and after getting robbed.
The study of repeat criminals wondering around the USA.
The study of the spread of Communist groups all over the USA and their supporters. The creation of a lot of informants that took effort and time.
Smartphones allow a few agents to use a GUI to map out hops of connections all over the USA.
PRISM and US designed junk consumer crypto gave the files, voice prints, movements. Real time voice on a live mic.

Re:How did they ever solve a case

[youngone]

Have a bank robbery problem? Talk to all bank staff...

The study of the spread of Communist groups all over the USA...

One of these things is not like the other.

Re:How did they ever solve a case

[Immerman]

>The only way the system works is if the balance between cost of prosecution and magnitude of the crime worth prosecuting remains stable

An alternative would be to enforce the law at all times and for all people, with no exceptions of any kind - the public backlash from that would be sufficient (in a legitimate democracy) to severely prune the law to the point that obeying all the laws at all times is actually an relatively easy thing to do.

Re: How did they ever solve a case

[sjames]

hddyf jfgrk jdgr yyhdy?

People have been recording things using pen, paper, and private codes and cyphers since before the United States even existed.

Beyond that, it was and still is harder to get a warrant for a locked drawer than for a smart phone.Encrypting the phone is just restoring the balance.

Re:How did they ever solve a case

[Immerman]

Hmm, so what happened in the 60s that caused all that crime - prohibition maybe? Lets criminalize the possession of many widely used recreational substances, and suddenly we have a huge crime problem, create massive black markets and the violence associated with them. The gang warfare. The militarization of police in order to be able to compete.

All of that was completely predictable - it all happened when we tried alcohol prohibition, and continued getting worse until that was repealed. You have to ask yourself - what was the real motive in trying it again?

Re: How did they ever solve a case

[Anonymous Coward]

Thank you.

So many people are making factitious arguments, but yours is one of the few that holds up logically. Keep it up!

This topic brings out all the angry posters, most saying it is impossible to do securely. That's provably false. Mixed with that are the ones saying it's effectively evil. Few people are taking the stance that law enforcement is trying to protect the public in a reasonable way. Yet the public and law enforcement think that is the case. Posting here does very little to change that public perception. However, you posting here, where the informed read and inform their opinions, can make a difference.

There are good reasons to doubt the effectiveness or cost ratio rationality of trying to legislate access to encrypted data. That matters. Thankfully there are people like you who are willing to advocate discussion to the real issues.

Obligatory: Posting AC due to posting of unpopular opinion.
Second thought: Unchecking "Post Anonymously" because it is worth taking responsibility when you believe in a cause.
Third thought: How much scotch have you had? Enough. Click the button.

Re: How did they ever solve a case

[argumentsockpuppet]

Oops, still forgot to uncheck the "Post Anonymously" box.

That much scotch. Salud.

Re:How did they ever solve a case

[RhettLivingston]

I agree and long pushed that. But I no longer believe it is a realistic alternative. The system is too entrenched. The best that can be done is to keep wounding the prosecution side.

Re: How did they ever solve a case

[Anonymous Coward]

Hidden messages have existed since before Christ fer Christ's sake!

In 499 BC, he shaved the head of his most trusted slave, tattooed a message on his head, and then waited for his hair to grow back. The slave was then sent to Aristagoras, who was instructed to shave the slave's head again and read the message, which told him to revolt against the Persians.

Re:How did they ever solve a case

[Type44Q]

How did they ever solve a case... before smartphones came along?

Whispering to each other, and passing coded messages... it was all illegal; don't you remember??

;)

Re: How did they ever solve a case

[RhettLivingston]

Not really. Smartphones collect data that was never written before and rarely recorded. It was in people's heads or simply nowhere unless someone followed you every moment of every day carefully recording things. By decrypting that, you've gained more than any search warrant was ever able to achieve. It is approaching the level of violating a person's right to refuse self-incrimination. The phone often remembers more than the target remembers about their own lives.

Re:How did they ever solve a case

[Anonymous Coward]

That is so spot on. I first saw this argument in an advanced grad level math example of applied calculus that proved the direct relationship between stronger drug laws and increased drug traffic due to higher prices and increased profits.

The laws created the market. We love to repeat our mistakes... wait. Perhaps it wasn't a mistake? Could it be that you're 100% right in that it was completely predictable? Perhaps the real motive in trying it again was to return to the good ol' days?

Re:How did they ever solve a case

[AHuxley]

Re "what was the real motive in trying it again?"
Drugs and the payments to ensure the drugs could move. The criminal pathways between Canada and up past CA.
That needed local and federal police not to investigate. A lot of federal informants and investigations had to be paid or stopped.
Good people in the FBI tried to study the problem, track the cash and flow of people drugs. The spread of Communism and its funding links to the drug trade.

The very way the USA worked changed with the money drugs used into parts of the USA.
A lot of criminal people got out into the community under health care reforms.

Re:How did they ever solve a case

[Immerman]

I think the problem is far more insidious than just an entrenched system - a system of unevenly applied laws, especially when the laws are so overreaching as to criminalize everyone, is a system in which those with power can arbitrarily punish anyone for any reason, using whatever crimes they've committed as the excuse.

Re:How did they ever solve a case

[Anonymous Coward]

Amen. That is the system that is entrenched. We have moved beyond the theory of its usage and are well into the fact. There is nothing arbitrary at all about who is punished and who isn't. There is no longer even an attempt to conceal it.

Re:How did they ever solve a case

[Anonymous Coward]

Have a bank robbery problem? Talk to all bank staff...

The study of the spread of Communist groups all over the USA...

One of these things is not like the other.

You're right. Bank robbers only steal money on a very small scale and usually don't kill people.

Re: How did they ever solve a case

[denis.goddard]

Monero FTW!

Re: How did they ever solve a case

[Anne Thwacks]

Well don't tell , or they will ask congress to abolish time!

Re:How did they ever solve a case

[Anonymous Coward]

Really? Your first thought isn't "why is there an increase in substance abuse"? You know, the ROOT of the problem. Kill the demand, the rest disappears.

Re:How did they ever solve a case

[Immerman]

Who says there was an increase in substance *abuse*? There was certainly a surge in substance *use*, primarily because it was closely tied to the cultural revolution. The abuse didn't seem to really set in until the 70s, when the combination of disillusioned revolutionaries and the consolidation of the black market started making for some real unpleasantness.

And what is your proposal for reducing demand? Criminalization does little to reduce it, which we knew quite well from the last time we tried prohibition. And it makes it a *lot* more difficult for people who've developed an addiction they're having trouble breaking to get help.

Re:How did they ever solve a case

[currently_awake]

In a country run by the 1% the spread of Socialism is counted as bank robbery.

Re:How did they ever solve a case

[Anonymous Coward]

No. I know why. Marketing. If you create a profitable market, pushers will come to convince people to try it. They will even go beyond that and provide free samples, etc. to make sure you are thoroughly hooked. The stronger the laws are against the product, the greater the profit on the product and the more aggressive the pushing. There will always be someone willing to take the risk.

Take away the profit by legalizing it all and making it over the counter as a generic without prescription and the "abuse" will gradually reduce back to acceptable levels. Most who get hooked on drugs would never have tried them if not for pushers.

Also, take away the cost and require generic production to be of consistent quality and almost all of the bad effects of "abuse" will disappear long before usage dwindles away. Nobody will have to steal to pay for them and nobody will OD because the new batch is suddenly an order of magnitude stronger than the last one. There is a greater percentage of drug addicts amongst the wealthy than amongst the poor. Why is it not a problem? Because they can afford the cost of the good stuff without stealing (any more than they usually do).

Obviously

[Anonymous Coward]

Obviously, truly dangerous criminals will use strong encryption. He's living in a fantasy world where no one adapts or changes their behavior.

And, my oh my, what ever did they do before electronic communication was widespread?

Re:Obviously

[Narcocide]

They just read your mail illegally, instead.

SAY IT ALL WITH ME, NOW:

[Rick Schumann]

When encryption has backdoors, then NO ONE will have encryption at all

You CANNOT have 'backdoors' in an encyption algorithm and still have effective encryption, goddamnit!

Clearly the FBI and Congress doesn't give a rat's ass whether or not anyone has secure systems or not, so long as they can stick their little brown noses into everyones business. Who cares if every computer in the country is easily hacked by even script kiddies, everyones identity is stolen, and everyones bank accounts drained and credit cards charged up? The Feds will have 'unbreakable' encryption, as will all elected officials and of course The Rich, they'll all be exempt from it, while the rest of us are wide open to whoever wants to victimize us.

Them, them, FUCK THEM.

Re:SAY IT ALL WITH ME, NOW:

[Anonymous Coward]

A better saying, I think, is "You can't compromise with reality."

Re:SAY IT ALL WITH ME, NOW:

[Narcocide]

You can't compromise with reality but these people seem perfectly willing to ignore it completely.

Re:SAY IT ALL WITH ME, NOW:

[Anonymous Coward]

As perfectly illustrated by the current administration and those bleating support for them.

Re:SAY IT ALL WITH ME, NOW:

[gweihir]

The thing is that people like this guy have no clue what a "fact" is. He thinks it all comes down to power and that, given enough power, a certain "reality" can be enforced. It is a typical mental defect found in basically any fanatics. A still very instructive example of that is when the catholic church tried to force the world to be flat. They had absolutely no understanding that the shape of the planet did not care about them one bit and that all their power had zero influence on reality.

Still, people like that in position of power is a sign of a sick society. It is a severe problem.

Re:SAY IT ALL WITH ME, NOW:

[Anonymous Coward]

When encryption has backdoors, then NO ONE will have encryption at all

You CANNOT have 'backdoors' in an encyption algorithm and still have effective encryption, goddamnit!
 

While I support encryption, this missing a valid way to achieve the stated goals. Yes, a backdoor is bad, but there is an alternative that is if not good, then not as bad. Basically here is the idea:

1. Tech manufacturers escrow a recovery key that is much longer than a normal key at their premises in one or more closed rooms that have high security no network/etc.

2. This is a per device key. Give the company who makes the device a court order and they will send someone into the room to return a single recovery key. No the government can't copy the entire database.

3. This key can either backup a copy of the in use key on the device or be the ultimate key used for encryption. Your key could just decrypts a copy of this true key. There are lots of reasons that is not a great idea, but it isn't the end of the world either, since these are per device keys.

I'm not advocating it, but it would meet some of their demands. Of course you can do encryption with javascript, so good luck stopping anyone but the small time guys. There are countless ways around anything they do, unless your going to ban peoples ability to use a programming language...

Re:SAY IT ALL WITH ME, NOW:

[drinkypoo]

It's not about brown noses, it's about brown shirts.

It's not about the rich, it's about the Reich.

Re:SAY IT ALL WITH ME, NOW:

[Anonymous Coward]

There can be NO compromise! Compromised encryption is worse than no encryption! What is needed are devices with unbreakable encryption. That means no way to unlock the device without the pass-phrase, no way to open the device or connect anything to the device while it is locked without completely destroying any data that the device contains. A duress pass-phrase that deletes all data instead of unlocking the device is also a good idea!

Crimes were solved before there were computers and smartphones. Police, CIA, FBI, etc... do not need to access our personal devices at all to solve crimes...they just want to be lazy and not have to do the extra work to solve the crimes without access to our devices!!

Re:SAY IT ALL WITH ME, NOW:

[Powercntrl]

You CANNOT have 'backdoors' in an encyption algorithm and still have effective encryption, goddamnit!

It's disingenuous to claim backdoors are the only way of allowing law enforcement to gain access to an encrypted phone. As an example, if Apple had each iPhone transmit its unique decryption key to Apple's secure iCloud servers as part of the initial activation process, complying with a court order to decrypt a phone would be no problem. The "lock" itself is still just as secure, you just are no longer the only person with the "key".

You can't fix a lack of good privacy laws with a technical solution, because literally or figuratively, the government will just bring out their $5 wrench.

Re:SAY IT ALL WITH ME, NOW:

[Anonymous Coward]

At this rate, rusians will have the master key before anyone, and you know what I mean.

Re: SAY IT ALL WITH ME, NOW:

[Anonymous Coward]

That's not secure. All it takes is a $5 wrench or ability to send the right person some kiddie porn to get access to all of the phones.

Re: SAY IT ALL WITH ME, NOW:

[houghi]

This is the time of newspeak. Uber is not a taxi company. Quting potus is loies. Ingnorence is strength. We have always been at war with terrorism. Backdoors are secrecy. Freedom is slavery.

Re:SAY IT ALL WITH ME, NOW:

[dwillden]

I'm not saying they won't try to legislate it away. But don't toss Congress in with the FBI yet. The head of the FBI saying he'll get legislation is different from him actually getting it passed. Not when Google, Apple et al have very, very deep pockets for buying congress critters. And even if it passes will it stand up to constitutional challenge as a violation of the freedom of speech and of the right to privacy.

Honestly it could go either way with congress. There are multiple prominent congress critters who would oppose this already, even before any effort to buy them off by the industry. But a few billion here, and a few billion there and that legislation is dead in the water no matter how much Mr. Wray cries for it.

Re:SAY IT ALL WITH ME, NOW:

[Rick Schumann]

In the immortal words of Adam Savage, "I reject your reality and substitute my own!", but they're not kidding.
It's kind of like Vegans; they think that a 'moral choice' plus 'force of will' can somehow override hundreds of thousands/millions of years of evolution shaping our DNA, and have no health consequences.

FBI

[Anonymous Coward]

Let us not forget the Democrats want this more than Republicans. Use open source software and encrypt the hell out everything.

only remedy is a backdoor

[Anonymous Coward]

and that will make everyone unsafe for certain.

Exactly how much info do they want?

[SmaryJerry]

They can track who you contacted, when you sent something, any time a dollar changes hand, any item you send in physical mail, but for some reason ease dropping on conversations in iMessage, Line or Whatsapp is the biggest obstacle they have? If anything they should be able to do the same police work they always have but even better now that they are collecting a ton of meta data and other various digital information about a subject.

Re: Exactly how much info do they want?

[Anonymous Coward]

I don't know why they don't just storm all the data centers with tanks and swat teams already. Adding legislation into the mix just to make them feel better about storming data centers with tanks and swat teams just doesn't seem to make much difference.

Better yet they can do it under the guise of national security. Alternatively we could just create a new task force to deal with this encryption menace: Let's call it The Stasi.

Re:Exactly how much info do they want?

[sjames]

They believe everyone else to be inferior to them and so unworthy of the right to keep a secret from them.

encryption

[Anonymous Coward]

Sorry you after birth of a Bulgarian butt fuck no room what so ever it is now what it is.
Fuck you.

Encryption justifies waterboarding

[Anonymous Coward]

Maybe the solution is not to add new legislation but to relax other that already exist.

Less safe.. great argument....

[SmaryJerry]

"People are less safe as a result of it." People are less safe by leaving their room every day. Some things are just expected to be "less safe" but we do them because we want to be more than prisoners.

Re:Less safe.. great argument....

[weilawei]

People are absolutely less safe by the use of backdoors in encryption. You don't give any random person on the street, do you now? When did it become a law that we give our house keys to the government?

Government mandated backdoors are absolutely and utterly untenable in a free society.

Re:Less safe.. great argument....

[weilawei]

Well, screwed the pooch on that preview, didn't we now. You don't give any random person your house key, do you now?

Re:Less safe.. great argument....

[viperidaenz]

The government don't need your house keys, they can legally break your door down and have the tools at their disposal to do so.

Re:Less safe.. great argument....

[Anonymous Coward]

People are less safe by leaving their room every day.

That's why I never do that! Suck it, normies!

Re:Less safe.. great argument....

[Anonymous Coward]

We don't live in a free society in America. We live in a society of fear, based loosely on boogeymen called terrorists, which are apparently everywhere, and you need to give up all of your freedom in order to be safe from them.

The freedom ended decades ago. It's only now that some of us are beginning to be aware of that fact.

A very binary issue

[Voyager529]

They keep talking about "compromise" as if Tim Cook and Larry Page have everyone's encryption keys in a file on their laptops that they refuse to hand over for convicted mobsters. That sort of mindset just does not reflect the nature of the situation.

Here is what it ultimately boils down to:

1. The user - and only the user - has the encryption key.
2. Companies are compelled to sell devices that cannot be secured at all, because a 'master key' lives somewhere.

That's it. Those are the two options. There is no way for the phone to verify if there is a warrant, or if the person inputting the master key is truly a law enforcement agent or not, or any other way to ensure the individual using the master key is justified in doing so, or any means of discriminating between a hack and a court order.

If Wray would like to come up with a third option that doesn't ultimately fall into the category of one of the other two, he's welcome to try. Smarter people have failed.

Re:A very binary issue

[gweihir]

They keep talking about "compromise" as if Tim Cook and Larry Page have everyone's encryption keys in a file on their laptops that they refuse to hand over for convicted mobsters. That sort of mindset just does not reflect the nature of the situation.

These people have no understanding of reality. They are fanatics. They live in a fantasy-world where the powerful dictate reality and reality complies. They have no understanding of what a "fact" is and think they can just threaten it long enough and it will change.

Re:A very binary issue

[Anonymous Coward]

These people have no understanding of reality. They are fanatics. They live in a fantasy-world where the powerful dictate reality and reality complies. They have no understanding of what a "fact" is and think they can just threaten it long enough and it will change.

Either that, or they do know, and they're using this crap about "terrorists" or whatever is the current root password to the constitution to destroy our freedoms forever.

Unfortunately, I think that for some of them, it is fully intentional malice, not just idiotic fanaticism.

Re:A very binary issue

[gweihir]

I am going with Hanlon's razor here. Of course, there is a lot of people that gladly would cheer in fascism for all the great benefits to society it brings in their minds and some of them will not even admit being wrong when it ends in utter catastrophe (as fascism sooner or later always does). Are these people stupid or malicious?

When looking at the details, this question gets really difficult to answer. I like to think these people are defect in some way and really cannot see how evil their acts are. They are unable to learn from history or experience and, at the same time, are convinced they have it all figured out.

People that are evil, know it and are fine with it are really rare. Almost all evil people have some rationalization, like "protecting the country" or "fighting the bad guys" or "giving the master-race the place it deserves" and the like and typically lack the mental ability to see that these are just excuses for something else.

Re:A very binary issue

[Anonymous Coward]

We call them psychopaths: The traits are common: constant lies, deceit and working against others for their detriment.

Yet, true psychopaths compromise just 2%. It's we who create psychipathic systems, by worshipping them.

Re:A very binary issue

[gweihir]

I don't thinks so. Take Trump for example: Clearly a narcissist, clearly a (bad) liar, clearly not very smart, but a psychopath? I don't think so. But look at the ones that voted for him and the many that still cheer him on and think he is doing a good job. These are far too many to be psychopaths. Also clearly too many to be intentionally evil and proud of it. But what are they? I think they are just unable to see reality and unable to see the evil they are supporting. That makes them idiots, but not intentionally evil or destructive.

Re:A very binary issue

[Anne Thwacks]

These people have no understanding of reality.

Correct. A politician, asked "what is the truth?" answered "the truth is what I say it is!"

This was a British Labour (socialist) politician, when I heard him say it on TV but

A) He had clearly been taught this by someone (his dad?)
B) A lot of people think this way - it is probably common for a certain sector of society (Orange coloured ones?)

Theoretically, it is the Abrahamic faiths that argued against this with "there is one God, and therefore one truth: that which God sees".

When at sea, sailing under a British Admiral, I was told "You can argue with the captain, but you cannot argue with the sea. Arguing with the admiral may see you strung up from the yard-arm!"

Arguing with pirate captains (or sailors rougher than yourself) will may end in an unfortunate accident.

Re:A very binary issue

[Dragonslicer]

1. The user - and only the user - has the encryption key.
2. Companies are compelled to sell devices that cannot be secured at all, because a 'master key' lives somewhere.

If Wray would like to come up with a third option that doesn't ultimately fall into the category of one of the other two, he's welcome to try. Smarter people have failed.

I suppose it's just a variation on option 1, but how about allowing judges to issue search warrants that cover materials stored on a person's phone? There would be quite a few details to work out to ensure protection from testifying against yourself, but I don't think any such issues are insurmountable. Obviously the police would have to be able to demonstrate that the phone is yours (found it in a parking lot at a mall near your office, no; found it in your pocket when they arrested you, yes). And in case someone wants to bring up the ridiculous idea that a person's password is "IKilledThatHooker", arrangements can be made to change the password before turning over the phone, most likely involving attorneys for both sides and maybe even an independent third party.

Re:A very binary issue

[grep -v '.*' *]

Here is what it ultimately boils down to:

1. The user
2. Companies with ... a 'master key'

Or there actually is a 1b: At message generation time when the message it still in the clear, you generate the standard encrypted message AND(!) you generate a duplicate one with the users private key (you just used it a second ago) and the FBI's (whomever) public key. This two-times as large message is what is actually sent.

So the receiver gets it and decrypts it like normal. If the FBI (\a{3}) gets it, they decrypt THEIR half of the message, leaving the original encrypted. They've got the private key, the user's public key is already known. This way the math doesn't change/break and all of the CongressCritters are happy.

If (when) the FBI private key is compromised, you change it to protect all future messages. If you find someone without a second embedded message or the length doesn't match, you round them up and educate them on the error of their ways. If you later on investigate and discover a complete message mismatch, they're obviously evil and so you educate them again. Permanently.

Re:A very binary issue

[currently_awake]

American society does a good job of stamping out the ability to think logically.

Re:A very binary issue

[Voyager529]

I can think of plenty of issues with this system off the top of my head...

1.) Storage and bandwidth costs double. Sure, it's not much for one phone, or even a thousand phones...but it *will* move the needle measurably for the telcos.
2.) There's no guarantee the FBI's private key won't be compromised. Snowden made it clear that the TLA's can't keep their sensitive data hidden well, and while I'm sure security has improved, it's a very, very lucrative target and a very, very small package to extricate.
3.) Even if it's never compromised and is only used by the FBI, it's not possible to verify that the message is being decrypted as the result of a warrant or other truly valid reason.
4.) This system doesn't address situations like data stored exclusively on the phone, only what is transmitted. Photos taken on the phone, for example, wouldn't be subject to this system. If the answer is that encrypted storage is possible to decrypt with the FBI private key, points 2 and 3 doubly apply.
5.) Revoking and reissuing the FBI key assumes the software vendors are able and willing to keep pushing updates to those phones. If they don't, then old phones will be forever compromised.
6.) There's nothing preventing the message being transmitted from itself being encrypted with yet another key...and the race begins all over again.

Re:A very binary issue

[gweihir]

Indeed. And is not a well-developed capability in most people in the first place. Not that the US is unique in that regard.

Re:A very binary issue

[Lonewolf666]

If (when) the FBI private key is compromised, you change it to protect all future messages. If you find someone without a second embedded message or the length doesn't match, you round them up and educate them on the error of their ways. If you later on investigate and discover a complete message mismatch, they're obviously evil and so you educate them again. Permanently.

A possible way this could go wrong:
The Russians (who else ;) get their hands on the FBI private key but manage to keep that a secret. Now they can decrypt just like the FBI does.

(Almost) everyone else thinks they are safe thanks to encryption which only the good guys can break. Russians read everything they can get their hands on, no matter if encrypted or not.

But it gets better:
The Russians do now have both the public and the private key of the sender. If the same keys are used for digital signatures, they can now create fake messages with "proof" that it came from the sender.
Come to think of it, the FBI could do the same => planting evidence made easy. Oh no, they would neeever do that...

Follow the money...

[Anonymous Coward]

Seriously. I'll bet this shit comes back to some from China / India / G20 country..

To think people faught and died for freedom only to have it slowly torn away by assholes like this guy. Disgusting.

It's not their job to prevent crime

[J053]

It is not the job of the security services to prevent crime/terrorism/kiddie porn/copyright infringement/whatever. It is their job to investigate after the fact in order to convict those responsible. That's how our justice system works. The only justification for the ability to decrypt all encryption is for (attempted - in reality it will never work) prevention.

After a crime has been committed, in order to obtain evidence, the authorities can always obtain a warrant to compel a device owner to decrypt/unlock a device. If the owner refuses, that's what contempt of court is for. If the device owner is dead, who gives a fuck what's on the phone? If the owner (presumed criminal) is willing to sit in jail indefinitely for refusing to unlock/decrypt, that is an acceptable outcome.

Re:It's not their job to prevent crime

[Anonymous Coward]

It's not acceptable to incarcerate someone long term without a conviction. At least it didn't used to be, until of course Bush and Obama kept people at Guantanamo without trials. In any case, they don't need contempt, they will just say you obstructed justice and get a conviction.

In any case, you can't be compelled to testify against yourself, so they haven't got much leg to stand on with contempt. That is the equivalent of saying well you didn't get on the witness stand, you are in contempt of court. Ridiculous. Any good lawyer should get that squashed. Could result in a mistrial too if the judge is biased.

Re:It's not their job to prevent crime

[Anonymous Coward]

You must be old and out of touch, or something.

https://www.miamiherald.com/news/state/florida/article214948205.html

Re:It's not their job to prevent crime

[oldgraybeard]

Government keeps Americans in jails for extended periods of time without a conviction all the time. The poor can not afford bail, thus sit in jail waiting for the painfully slow wheels of justice to turn.
Ideological foes and white collar criminals sit in jail with bond revoked at the prosecutors whim. With the bait of turning in to a state witness and providing the goods (true or made up) to regain their freedom.

Our justice system due to the corrupt leadership at these entities is in danger. I see a time when citizens won't even be able to afford to convict a real criminal.

Just my 2 cents ;)

Re:It's not their job to prevent crime

[Known Nutter]

After a crime has been committed, in order to obtain evidence, the authorities can always obtain a warrant to compel a device owner to decrypt/unlock a device. If the owner refuses, that's what contempt of court is for. If the device owner is dead, who gives a fuck what's on the phone? If the owner (presumed criminal) is willing to sit in jail indefinitely for refusing to unlock/decrypt, that is an acceptable outcome.

You need to read this:

Amendment V

No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a grand jury, except in cases arising in the land or naval forces, or in the militia, when in actual service in time of war or public danger; nor shall any person be subject for the same offense to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.

In other words, you can take what I have, but not what I know.

Re:It's not their job to prevent crime

[msauve]

The logic is that biometrics are physical facts, a password is knowledge.

In my view, encryption is a free speech issue - I have every right to encode my "speech" any way I wish, it's simply a very private language.

Re: It's not their job to prevent crime

[houghi]

What if I do not have the key to open it? I know there are several instances where I have no idea on how to access it.
Or what if a person hacked my email account and used it to hide stuff? There could be things that proves me innocent.

And do not say "I forgot it" Say, I have no recollection of it." Even better is to let your lawyer say it.

Re:It's not their job to prevent crime

[Anonymous Coward]

Although I agree with you on the stance of encryption, I do not agree with you that law enforcement/security services should only investigate after the fact.

Crime prevention is an important part of law enforcement and a role for the government BUT NOT AT ANY COST.

Preventing a crime often cost less than cleaning up after the crime has happened and makes for less victims of crime. Still, the when preventing crime what you do must be in relation to what you are trying to prevent. You could prevent copyright infringement by poking everyones eyes and eardrums out. If you can't listen to or see something, no one would be interested in copying material.

You could prevent murder by killing everyone in the first place, since you cannot kill someone twice.

Yes, these two examples are hyperbole and ridiculous. But somewhere in the middle is the requirement to backdoor any kind of encryption in the hope that some day, some terrorist or criminal, might get caught, totally disregarding the fact that those same terrorists or criminals might be able to use those backdoors to steal money from people (when the banking systems cannot use secure connections anymore) to fund their dirty business. It is naive and stupid.

Still, crime prevention per se is nothing bad, only some of the methods used or proposed are. I'd rather have the police keeping an eye out, listening to tips and stepping in and preventing a school shooter before they shoot up the school rather than letting them commit the crime and then try to punish them for it.

Re:It's not their job to prevent crime

[drinkypoo]

Total and complete bullshit. Security forces are always working to prevent those things. That they cannot prevent every instance is not a valid counterargument. Cops patrol to show the colors, hell even security guards do that, and it is a fairly effective deterrent. The FBI and the military actively work to stop terrorist threats before they occur.

This is not an endorsement of crypto backdoors of course, but you literally could not be more wrong.

Re:It's not their job to prevent crime

[Anne Thwacks]

It is not the job of the security services to prevent crime/terrorism/kiddie porn/copyright infringement/whatever.

No their job is:
to commit crime/terrorism/kiddie porn/copyright infringement/whatever.
And then put the blame on others.

However, pretending that encryption (probably riddled with backdoors) is secure will hopefully discourage you from using something else which actually is secure.

Re: It's not their job to prevent crime

[Anonymous Coward]

I believe that wording exists to prevent torture to secure confessions.

Re:It's not their job to prevent crime

[Dragonslicer]

We need to treat anything that exists in an electronic device, encrypted, as an extension of your some fact in your head that can't be compelled out by legal process.

Why shouldn't anything that exists in an electronic device instead be treated as a document that can be the subject of a search warrant?

Yes, this is a legitimate question intended to seek an explanation for the opinion.

Re:It's not their job to prevent crime

[Dragonslicer]

Right now courts have (incorrectly, in my view) determined that providing biometrics is not testifying against yourself, but being forced to provide a password is. It's just a really weird place.

I meant to add, it's not all that difficult to turn over a phone and/or its documents without providing the password to law enforcement. You could just change the password before turning it over. Alternatively, you could use an independent third party to get the documents from the phone (yes, I'm aware of the potential issues, which is I why I think this is the worse option).

Re: It's not their job to prevent crime

[Anonymous Coward]

I believe that wording exists to prevent torture to secure confessions.

And yet, it still happens.

Re:It's not their job to prevent crime

[tepples]

Can you interpret your language in real time without electronic assistance?

Re:It's not their job to prevent crime

[msauve]

Non sequitur.

Re:It's not their job to prevent crime

[tepples]

How does it not follow? I speculate that lawmakers would consider drawing a distinction between the obscure language of the Native American code talkers and something as intricate as OpenPGP in that the former is practical without electronic assistance and the latter is not.

Re:It's not their job to prevent crime

[msauve]

Why would the use of electronics change one's rights? You need electronics to send and receive email - would you also argue that free speech via email is not a right?

Re:It's not their job to prevent crime

[tepples]

Existing law makes a distinction based on medium. Speech over radio frequency transmission, for example, is not free; the FCC and foreign counterparts regulate it.

Re:It's not their job to prevent crime

[msauve]

Want to try again? You're getting way off topic. Access to RF is regulated because it's naturally constrained and goes everywhere. There are the "7 dirty words" for public broadcast stations, but there's also WiFi with no speech limitations.

You also can't yell "Fire" in a theater.

Re:It's not their job to prevent crime

[tepples]

In my view, encryption is a free speech issue
[...]
You also can't yell "Fire" in a theater.

Thank you for conceding that free speech is not absolute, even under United States law.

There are the "7 dirty words" for public broadcast stations, but there's also WiFi with no speech limitations.

And there is one qualitative technical difference between these: the technology that can be used to speak at greater distances is regulated. Likewise, in the case of encryption, the technology that can be used to encrypt more strongly than can be decrypted by merely learning the language from a cooperating native speaker could be regulated. And even under an assumption that code is speech, the growing popularity of platforms that don't allow a compiler to run (such as iOS and game consoles) could allow a government to regulate distribution of object code differently from distribution of a computer program in the preferred form for making modifications.

Re:It's not their job to prevent crime

[msauve]

"in the case of encryption, the technology that can be used to encrypt more strongly than can be decrypted by merely learning the language from a cooperating native speaker could be regulated"

You say that, but have failed to make any case to support it.

Anti-American. Anti-Democratic.

[gerald.edward.butler]

Please, I don't give a rat's ass about what evidence you can or can't gather from devices. It isn't pertinent to the discussion. People should be able to have private conversations that you don't get access to under ANY circumstances for whatever damn reason they please. Go F yourself. You anti-american, anti-democratic, nazi, communist, dick-weed. YOU are the enemy of the people. The "criminals" and "terrorists" are the least of our problems. You are and your ilk are to be feared and removed from office. You are the danger. You are not the solution. You are the problem.

Re:Anti-American. Anti-Democratic.

[Anonymous Coward]

Douche bag

Re:Anti-American. Anti-Democratic.

[Anonymous Coward]

Yeah, he's a douche bag too. That was missing from the rant.

Encryption in unconstitutional.

[Anonymous Coward]

For over two hundred years we didn't have cellphone encryption so there is no reason to start now! If we had a right to encrypted communications the founding fathers would have put it into the Bill of Rights. Just think of all the crimes that would never have been solved if people could have used encrypted cell phones. History has proven one thing the only way to solve crimes is by getting access to personal cell phone data.

Re:Encryption in unconstitutional.

[Anonymous Coward]

and so are:

-automatic firearms. The founding fathers did not have these, ergo, they are not needed.
-high capacity magazines: the founding fathers did not have these, ergo, they are not needed.

just think of the crimes that would not have happened if people did not have access to these things, these things that are unconstitutional.

history has proven one that, the only way to prevent crimes is to follow the letter of the 2nd amendment to the letter. People can have as many firearms as they like, so far as they follow the designs available to the founders of the constitution at that time. If the first POTUS wanted us to have technology, it would have been an unalienable right.

Re:Encryption in unconstitutional.

[Anonymous Coward]

I read in my history books that the traitor George Washington used cryptography to hide messages from the legitimate government of His Majesty the King.

If this whole "right to private communication" thing didn't exist, that traitor George Washington would not have been able to subvert the rightful government of His Majesty the King.

All papers should have been available for inspection. It would have prevent the most sinister of documents, the declaration of war known as the "Declaration of Independance", enabling the traitors to rebel against a legitimate ruling party.

Re:Encryption in unconstitutional.

[Anonymous Coward]

You are trying to be sarcastic right? You might be but it comes across quite poorly.

Anyway encryption predates both the founding fathers and cell phones by several centuries. So if the founding fathers wanted to mention encrypted communication in the Bill of Rights, they had all the chances in the world to do so. So your little sarcasm actually doesn't work as intended.

Re:Encryption in unconstitutional.

[Bob the Super Hamste]

While I do recognize the sarcasm it should be noted that one of the founding fathers did know a fair amount about cryptography and even made one of the strongest ciphers of the day. A form of it remained in use through WWII by the US army's signal corps as the M-94 cipher device as it provided enough protection for data that had a very limited lifetime.

Re:Encryption in unconstitutional.

[Anonymous Coward]

Such a shame that not even metadata was collected back then. The filthy traitors could have been rounded up.

Roll your own crypto

[Anonymous Coward]

Don't listen to them. You need understand how to generate good entropy, that's about it.

Forget about all the stupid academic attacks you hear about. Cache timing attacks, differential power analysis. Give me a fuckin break. Nobody is going to crack your homebrew algo with power analysis. These are ridiculous lab setups where the machine is all scoped out and they are hammering a well-known algorithm and looking for differences in the behaviour which leak key or psrng states.

The weakness is exactly because it's a 'well-known' algoritm.

Roll your own crypto and make the confusion/diffusion steps as expensive as you can. Make sure it has no math shortcuts. This kills the fed supercomputer. It has no frame of reference. Decrypting a blob of perfectly smooth data from an unknown algorithm with no key is like figuring out exactly how the universe works just by guessing.

Re:Roll your own crypto

[gweihir]

Spoken like a true amateur that failed (or never had) Crypto 101. You know why most home-brew crypto is never broken? Because the people that can do it do not want to waste the little time that usually takes. This situation changes when somebody is willing to pay for it, but you do not read about it in the scientific literature, because nobody cares.

Home-brew crypto stopped to be an option a few decades back.

Re:Roll your own crypto

[Anonymous Coward]

People like you who failed (or never understood) how to put cryptographic primitives together deserve to be restricted.

Hope they take away your rights & public algos.

Re:Roll your own crypto

[gweihir]

Hehehehe, I know enough to know how difficult it is to actually get right as it comes very much down to the details. Just throwing a few s-boxes that look good into a Feistel-network will _not_ cut it. Puts me far ahead of you, apparently. But I also have enough understanding to see how even absolute experts can fail at it. As examples, the AES competition or the password hashing challenge were quite instructive.

At this time, rolling your own crypto (unless you are one of maybe 100 people on the planet that really know how to do it) is a pretty sure way to failure. Recommending to people to do it is active sabotage and can only be called malicious. The other thing is that it is useless to do so anyways, because what are you going to use it for? For communication it has no worth, because others would need to use it as well. That would automatically make it a target for those that want to break it. For file/disk-encryption, if you are concerned, just layer a few algorithms with independent keys. If you actually knew how this works, you would know that there is no way in hell to break into something like this (done right of course).

Re:Roll your own crypto

[gweihir]

BTW, "be restricted"? That is some very uncommon use of language in civilian society. Are you a fed or with some other TLA? Would explain why you are maliciously trying to get people to shoot themselves in the foot. Anyways, you are pretty clearly part of the problem here.

Re:Roll your own crypto

[Anonymous Coward]

I hear this, but I don't think most people are being creative enough with it. Truecrypt and its successors have options to use, for instance, AES, Twofish, Serpent. I don't know how much effort it would take to create a derivate of, say, Twofish, that is possibly different enough that it would spoil an off the shelf solution that was somehow capable of attacking Twofish. If you then use your crypto program to make AES, Twofish-ripoff, Serpent, you'll have something that:
1)- Is at least as secure as AES and Serpent
2)- Is probably weaker than AES, Twofish, Serpent (because your amateur knockoff won't be as good in general)
3)- Would not be subject to an attack that actually CAN target AES, Twofish, Serpent, unless the attacker spends the time and money to attack your knockoff.

I don't think anyone does this, but I wouldn't say it is, strictly speaking, not an option.

Re:Roll your own crypto

[gweihir]

It is completely useless though. No modern carefully and publicly reviewed cipher has been broken in the practical sense in a long, long time. (Note that "publicly reviewed" also means that actual experts did take an interest.) However, a lot of implementation mistakes _have_ been used to do successful attacks. You are barking up the wrong tree.

There is also a risk-management angle here: If, say, AES has a backdoor, it would not be a "nobus" backdoor, as these basically do not work for block-ciphers. Nobody would take the risk of putting something in there that an attacker can also find. If you distrust ciphers, then distrust ECC with curves where you cannot verify how they were generated. ECC very much does allows "nobus" backdoors.

Re:Roll your own crypto

[Anonymous Coward]

"that look good" is a vague, meaningless kind of measurement, but if that's how rigorously you evaluate an algorithm then, yes - nobody wants you designing anything. Unfortunately, not everyone has your unique ability to spot flaws in designs that don't even exist with just heuristic guesswork and some kind of telepathic cryptanalysis. Also, you seem to be under the impression that the recommendation is to abandon or replace currently working, proven security - rather than a suggestion for what could be done if it were stripped from you by law. Is English not your first language?

Re:Roll your own crypto

[gweihir]

Are you an idiot? Because it sounds very much like you are. (Or course, you would be unaware of that, so this is a retorical question....)

First, do you really think anybody except a very experienced mathematical cryptographer _can_ actually evaluate s-boxes? If so, you are utterly delusional.

Second, if they outlaw, say, AES, they would outlaw home brew ciphers at the same time. They tried this already, and you should know unless you have no knowledge of the history of cryptography. And if they do and you just cannot get implementations anymore, in what way would just re-implementing AES be inferior to cooking your own thing? Of course, you may not actually have the standard lying around. I do.

Seriously, you are making all the clueless-crypto-nerd mistakes and you are giving really bad advice. Stop.

Re:Roll your own crypto

[Anonymous Coward]

Did you miss the salient part about "not abandoning current crypto", *specifically* correcting your misguided impression? Or does your omniscience interfere with basic comprehension?

You couldn't decrypt a sentence in plain English, you sputtering fuck. Go hang the spec next to your Fields Medal.

Re:Roll your own crypto

[Bob the Super Hamste]

To add to your points even experienced respected cryptographers fuck it up some times. Doing cryptography is hard and doing it right is even harder. Concepts like confusion and diffusion are difficult to master and implement. The a good bet for an amateur would be to take an existing block cipher and increase the round count if they wanted to roll their own but then they would need to also generate more round keys. So maybe the best course of action would be to take a 3DES approach to AES and create 3AES. If someone told me today to make some custom block cipher that is what I would do as it would be no worse than existing AES.

Re:Roll your own crypto

[gweihir]

3DES has the problem that the keys are not independent. I don't think anybody ever found a flaw with that, but a lot of experts found this troubling. Increasing round count is also tricky, because of the key-schedule. I think the best course of action for an amateur is to just bite the bullet and use several ciphers with independent keys and just accept the longer key-length. But seriously, I don't see any need for new ciphers at this time. Breaking AES directly will be infeasible for quite a while, probably for very long. Basically all practical attacks in modern times are via protocol and implementation flaws.

Compromise my ass.

[catsRus]

Anytime any political type of any stripe says they just want compromise, what they mean is they want capitulation.

Re:Privacy is great in theory

[Anonymous Coward]

You know what would be an even better tool to help those efforts? Having a sane, rational foreign policy that doesn't result in the creation of terrorists in the first place.

Re:Privacy is great in theory

[rogoshen1]

that is some weapons grade trolling -- kudos.

Re:Privacy is great in theory

[Anonymous Coward]

People have forgotten the lessons of 9/11, the gut wrenching feelings when we collectively watched those towers fall. Hopefully law enforcement can prevent us from revisiting those days. Key escrow would be a good tool to help those efforts.

What lessons are you talking about?

The terrorists didn't use any encryption in their communications:
https://brian.carnell.com/articles/2001/would-encryption-controls-have-prevented-the-911-attack/

legislating back doors..

[Anonymous Coward]

will just push the rest of the world to products and services from OTHER COUNTRIES...

while open source and 'bootleg' imported hardware will take over THIS one.

is that what you want? is that what your party's puppet masters (i.e. the big companies and campaign 'donors') want?

didn't think so.

back doors built into products will get owned by hostile entities. you can't control it. don't even fucking try.

Do it already

[Anonymous Coward]

I want to watch the fallout. I want to see the shit-show descend on their heads while they wail about how the sky is falling and everybody else is to blame.

Look at these Bastards

[Anonymous Coward]

Doing everything they can to break privacy, and ensure they can eavesdrop.

Keep voting for "tough on crime" politicians

[rsilvergun]

and he'll get his legislation.

Re:Keep voting for "tough on crime" politicians

[c horde]

Tough on crime politicians are fine. It is the politicians that want to destroy your liberties are the ones you want not to vote for. There is a huge list of Democrats and Republicans that don't belong in office. At least Trump is trying to destroy this disgusting mess in Washington. Any politician that supports this legislation, make them pay dearly. That may mean you have to break ranks with your Democrat colleagues. Trump supporters already hate the established Republicans, time Democrats do the same on their side, without electing Communists.

Re:Keep voting for "tough on crime" politicians

[c horde]

How are you relating FOSTA with creating back door systems? Sex trafficking != privacy

Re:Keep voting for "tough on crime" politicians

[Anonymous Coward]

Trump isn’t trying to fix this issue. Trump is trying to keep himself alive and make himself rich. That’s all.

Re:Keep voting for "tough on crime" politicians

[Shotgun]

You've overdosed on MSNBC. Here is an antidote to calm you down. http://www.magapill.com/

Re:Privacy is great in theory

[Narcocide]

Our government already knew everything there was to know about the 9/11 attack and chose not to act. You're a liar who knows they are lying as they are lying. Everyone here sees that. You are transparent.

Encryption with back doors

[jraff2]

Two Issues to consider - If an application was built with a backdoor the hackers of the world would invest their considerable talents and efforts into finding that back door and they will find it once found it will be abused. Once the back door has been uncovered the company who built the application would be required to fix it. Now who is going to pay for the fixing? Not the company because they know the same things that one is reading now. YOU will pay for the new application. YOU will pay to inform ALL the people who are using this now worthless application that it is broken and needs to be updated. YOU will pay to download and ensure that the new version is in use. This will happen over and over until YOU give up your foolish mandate. The state of Mississippi once considered mandating PI as 3. Same issue, politics needs to understand mandating foolish ideas makes one look like the fool they are! --- Since the world has MANY countries in it, any mandate for USofA would not apply to the other countries. Any person wanting or needing a non-FU encryption application would find one from some other source and use it. How are YOU going to mandate what application one uses to encrypt? You can't! Poof! There goes universal back door access!

Re:Privacy is great in theory

[Anonymous Coward]

Easier just to outlaw Islam tbh.

Over my dead body

[c horde]

Remember when all of those people screamed we should give up our firearms. They're screaming we need to give up our privacy and all other rights as well. Republicans and Democrats are a danger to all of us. Hopefully Trump will destroy the deep state before they destroy him.

Re:Over my dead body

[Anonymous Coward]

The Aristocrats!

FBI vs the NSA and Armed Forces

[davecb]

Spies and soldiers (especially on the spy side) need as good or better security than I need to talk to my bank. The CIA, military and (Canadian) CSE know it's a trade-off. The FBI and RCMP pitch it as a trivial question with an obvious answer.

For every hard problem there is always one clear, obvious and simple answer.. and it's wrong .

Another note

[c horde]

One other thought, if they're so worried about the Russians hacking our elections, why the hell would they want to cripple encryption? This all doesn't sound right. Alarm bells should be going off for everyone.

Do what Facebook, Goggle, did

[Anonymous Coward]

Give people free gigabit Internet in exchange for spyware apps voluntarily run.

People will sell out to that.

Delicious irony

[Anonymous Coward]

"I don't want to characterize private conversations we're having with people in the industry."

But he does want to characterize everybody else's private conversations.

Nineteen Eighty-four

[Anonymous Coward]

What's the point of everyone carrying around telescreens with them 24/7 if the thought police can't check up on what people are doing? It's a beautiful thing, the destruction of privacy and democracy. Mandated backdoors are doubleplusgood.

The REAL problem

[Anonymous Coward]

These government guys are like a shitty 8-track.

I'm presently studying digital forensics specializing in mobile forensics. We ARE -with a warrant- able to retrieve almost all of your location data in a timeline. We can -with a warrant- get your location when you made or received a call even if you let it go to voicemail. We can -with a warrant- get your complete call history, SMS and get your voicemails including quite a lot of deleted voicemail messages. We can -with a warrant or if a device was legitimately taken as evidence- extract tonnes of data wiped off of phones (except for blackberrys for some reason. when a blackberry does a datawipe it is not f$cking around).

80% of mobile phones seized are android phones. 90% of android phones have encryption disabled by default meaning physical extraction is reasonably simple. But that requires someone to do the job. Ignoring the 5% of IPhones collected as evidence, the big push is to use the seized mobile device as a gateway portal into all of your private online services like banking, email, IM(whatsapp,skype,etc), cloud storage(OneDrive, Google Drive,ICloud) and Social Media(Twitter, Facebook, Snapchat). By using the legally seized phone as a gateway to these services it bypasses the need to get a legal warrant for cooperation from these services.

The real problem these government assholes don't want to actually pay their forensic techs to extract the data. Also they DONT want to have to be bothered with getting a lawful warrant for the data they collect. The goal in most investigations seems to be collect everything (wildly invade peoples privacy) and then decide what is relevant later.

Saying this potentially puts my future job prospects at risk but the best way to f$ck overreaching government searches is if people insist their online services use TFA or MFA thats NOT based on SMS or email. Encryption doesn't hugely effect forensics in the majority of crimes. Properly done TFA or MFA would solve everyones privacy issues and f$ck over unlawful government overreach.

With proper online TFA/MFA, If the government has a legit LEGAL reason they can get the data. Otherwise they can go play in traffic.

Re:The REAL problem

[viperidaenz]

The goal in most investigations seems to be collect everything (wildly invade peoples privacy) and then decide what is relevant later.

Which makes all evidence gathered inadmissible, as well as any further evidence found because of the illegally obtained evidence.

It's the best way to have a court case thrown out, the criminals walk free, and never able to be prosecuted for those crimes again.

Encryption is ALWAYS available.

[Futurepower(R)]

Good comments:

"... there is still open source, free and openly available encryption."

"... there are phones moving across political boundaries."

Many people in government and in management of private companies have NO knowledge of technical issues. That doesn't prevent them from having what they consider to be a strong and sensible opinion. They don't recognize they are ignorant.

ALSO: Back doors are not an answer. They will ALWAYS eventually be compromised.

Re:Encryption is ALWAYS available.

[DigiShaman]

The NSA is a backdoor

Re:Encryption is ALWAYS available.

[Anonymous Coward]

They will ALWAYS eventually be compromised.

Absolutely. And if not by internal employees, then external entities acquiring them by compromising the target holder. I'm looking at you NSA!

Re: Encryption is ALWAYS available.

[Anonymous Coward]

Aka the Dunning Kruger effect

Re:Encryption is ALWAYS available.

[Lonewolf666]

If you mean the Snowden affair, that was (mostly) one guy with moral reservations. He may have had some outside help, but I think his motives were genuine.

The big mistake by the three letter agencies was to hire LOTS of consultants and assume none of them would have a motivation to go public. Having hundreds or even thousands of analysts makes it quite likely one of them talks.

As a citizen

[oldgraybeard]

I believe strong encryption protects me against both criminals and my government. We all know criminals are, well criminals! But the bureaucratic leadership of the NSA, DOJ and FBI IS corrupt. And at the moment, FBI Director Christopher Wray and his corrupt partners running the DOJ and NSA are the greatest cyber threat in America.
FBI Director Christopher Wray's statement that "strong encryption on mobile phones keeps law enforcement from gaining access to key evidence" is in my case falling on deaf ears. I do not see a problem here. Things are just as they should be.
And FBI Director Christopher Wray can pound sand. And he IS the weasel I suspected he was.

Just my 2 cents ;)

Re:As a citizen

[Anonymous Coward]

These days the government is made up of criminals (all republithugs are criminals)!

Re:As a citizen

[Anonymous Coward]

The Pentagon, FBI and NSA are criminals. Over 5200 people viewed child porn regularly at the Pentagon and nothing happened.

Remember the law only applies to you, the common serf, not the aristocracy.

UK vs IRA

[sit1963nz]

For decades the IRS was able to run sophisticated operations in Ireland.
This despite not having the internet or computers.

Google "Numbers stations", again been around for decades.

This has ZERO to do with making anyone "safe", its all about being able to control the masses.

Re:UK vs IRA

[viperidaenz]

numbers stations are for transmitting encrypted data.
If you don't have the right code book, it's impossible to decrypt.

What's that got to do with legislating against encryption?

Re:UK vs IRA

[Anne Thwacks]

numbers stations are for transmitting encrypted data

After thinking about this for about 50 years, I think you are wrong.

Numbers stations transmit the OTP. Many to one broadcasting is good for this.

The OTP is used to encrypt messages which are sent point-to-point by methods more suited to that. (RTTY?)

I can understand where he's coming from..

[schweini]

I'll get modded to hell for this, but I kind of agree with him?

Most people I know have no qualms about the way old-school wire-taps worked.
Law enforcement got a warrant from a judge, and only if the judge thought that there's enough reason to suspect the target is on to something, only THEN could they hook into a user's phone lines or open their mail. (or at least that's how it was supposed to work).
This, IMHO, seems like a good balance between the right to privacy and law enforcement needs, and has enough judicial oversight to not be easily abused.

I have no idea how one could implement a similar scheme nowadays. Backdoors are dangerous, and the oversight mechanisms have been broken for quite a while (just say "it's for national security!"). But having some means for the 'good' guys, with sufficient oversight, to be able to use surveillance to catch the baddies doesn't seem too bad to me?

Re:I can understand where he's coming from..

[drinkypoo]

There is no way to let the government read your secure files without making it easier for other parties to do the same. The government you have today may not be the government you have tomorrow. That's two reasons why it is too bad. One should suffice...

Re:I can understand where he's coming from..

[another_twilight]

Most people I know have no qualms about the way old-school wire-taps worked

Most people are poorly informed and concerned with food, rent and family. It's a poor metric to use.

Wire taps were and probably still are abused. Warrantless surveillance by various parties, warrants issued in a 'rubber stamp' process that makes a joke of oversight and it's not just 'national security'. It's self identifying 'good guys' seeing the restrictions of oversight as something to be overcome so that they can catch the 'bad guys'.

It's not just the oversight mechanisms that are broken, there are significant cultural attitudes that need to change - starting with 'good guy' and 'bad guy' thinking.

Re:I can understand where he's coming from..

[Bongo]

Ideally, the nation protects the people, and part of that is, good guys can catch the bad guys, and part of that is, having perfect information and knowledge of who the bad guys are and evidence of what they did. But that ideal has to cope with the practical problems of imperfection of all things: good guys are sometimes bad guys; good methods sometimes have bad outcomes; etc. And because encryption is, in practice, more of a binary thing, in that it either “works” or is “broken”, because unlike the locks on your house, if it is weak then the attack can enter from anywhere in the world in an instant, and because unlike tapping a phone call, these days the listening devices are everywhere and always on, and able to convert sound to text, and so everything is automated, it would just give a few bad good guys waaaaay too much power to cause harm, arguably outweighing the damage a lot of other bad guys could cause by other means. It’s the balance. It is one if those things where human nature has to evolve further and become generally less corrupt and biased, and then the bad good guys will stick out like a sore thumb, and then people will be able to trust the other people more, and then a sort of, totally open society can flourish, where anyone can turn on a camera and start talking to you no matter where you are or what you are doing. But until that self sustaining better nature becomes the norm, we need checks and balances.

Re:I can understand where he's coming from..

[scarboni888]

The "bad guys" will know enough to use unlegislatable open-source encryption methods only to further real crimes. Legislated back doors will be avoided by any criminal worth their salt.

Legislated back doors are for the rest of us plebes who might cross over the line into threatening power. They are also even better for targeting politicians whose ideologies aren't in line with the status quo.

Why can't people understand that?

Compromise

[Anonymous Coward]

As a compromise, the public can be given read-only access to every politicians:

-tax records
-bank accounts
-credit card statements
and their extended family as well

I mean, it's taxpayer money, so taxpayers deserve to know where it goes. And if they have nothing to hide, they have nothing to fear!

Every dime paid to a public servant should be fully traceable, fully open , fully public.

Re:Compromise

[Anonymous Coward]

So the cousin of a city councilman in Ardmore Oklahoma should have their privacy invaded? How totalitarian of you.

Every dime paid to a public servant should be fully traceable, fully open , fully public.

It already is. It's the politicians that break those laws that need to be investigated and put in jail, not to be given a get-out-of-jail card or be part of the above-the-law elite group that protects each other. Hillary, I'm thinking of you.

dd if=/dev/random of=/storage/2468-5569/Andriod/No

[karlandtanya]

repeat for count=0..32
Your honor, those files contain only random bytes; there is nothing to decrypt.

What's the bar? What is PRIVATE?

[charliemerritt03]

Just what is the point of your position Christopher Wray?

Let us say that I want to discuss what should happen to Putin's (censored)?
Should that (censored subject) be available to Putin?
Weak crypto is WEAK! Really, Chris it is WEAK - that is why it is called Weak, Bad, Backdoored.

Sit in on a 2 hr lecture on Crypto before you decide what is best, Chris.
We don't want our thoughts exposed to Russia, or anyone not on our mail list - Chris.

Encryption export policy reversed?

[viperidaenz]

Like the old export restrictions on strong cryptography, is USA going to ban imports of strong cryptography?

"I'm sorry, you can enter USA with your phone, it's too secure. Dispose of it or get back on the plane home"

Re:Encryption export policy reversed?

[Anonymous Coward]

They will first try to come up with some definition that includes Apple and Android but excludes desktop Linux and veracrypt. Then, once they have their precedent in court, they'll come for the rest of the encryption.

As a note, almost every government will go along with this. There will be a few holdouts in Europe, for awhile. But this is definitely the plan.

Re:Encryption export policy reversed?

[Anonymous Coward]

The restriction were based on the claim that strong encryption fell under "arms" control legislation.

So, seeing that encryption is an "arm", I hereby assert my right to bear arms.

Re:Encryption export policy reversed?

[Anonymous Coward]

The director lies. TA and DF gives lots of clues even if the encryttion is not broken. People walking around with a cowbell (aka smartphone) is all they need. They have had number called spidermaps for ages. Just call Mr Putin enough times, or private room conversations - and you are as guilty as sin.

Sure. As Long As...

[Anonymous Coward]

We get FDIC-style insurance for the trillions of dollars lost to the inevitable fraud, as FBI contractors make a little extra on the side from selling Master Keys (see "TSA").

Encryption is for traitors

[Anonymous Coward]

I read in my history books that the traitor George Washington used cryptography to hide messages from the legitimate government of His Majesty the King.

If this whole "right to private communication" thing didn't exist, that traitor George Washington would not have been able to subvert the rightful government of His Majesty the King.

All papers should have been available for inspection. It would have prevented the most sinister of documents, the declaration of war known as the "Declaration of Independance", enabling the traitors to rebel against a legitimate ruling party.

You have to encrypt it.

[Anonymous Coward]

If you could keep the "real assholes" who are held so highly in public from manipulating the data, then encryption wouldn't matter. Nothing will work if we don't encrypt and anyone can just "tap" into the fiber line (GPON makes that even easier).

You say you are going to quasi-encrypt it and only let the good guys know, yea right. Burn all the books!

Yes, I can re-calculate a checksum, I can't keep up with decrypting a random key though because it takes more energy to guess than to encrypt.

The sad thing is, this exact manipulation of data destroyed 10 years of hard work building a business for me because we'd prefer corruption as a form of education in this country it seems.

I still don't know why you can't make a phone that has real encryption, and just have an option to "share everything with the current good guys". Your problem there, when you encrypt with the "good guys" is that one bad apple just passes out your information, he probably just thought he was doing good out of his own ignorance but is too arrogant to realize he needs education and actually do something about it. Oh well he needed a job and you thought monitoring of private individuals information was the best fit for the level of stupid that he was. Then you didn't realize the repercussions of using this method to educate the idiot and the impact it would have on good people. Plus you spent 20 times as much money vs conventional education, all because the moron couldn't sit still and read a book and actually do the work.

No amount of DRM and no number of cameras is going to fix that. Gold.

But it's just random characters...

[Anonymous Coward]

What if I just like to email strings of random characters? How do you prove that something is encrypted?

Re:Privacy is great in theory

[Sique]

Tell me the point in time at which rapid decryption would have made it ossible to thwart 9/11!

That's like saying that because we had that big flood costing hundred of lives, it's necessary that everyone wears seatbelts!

There is nothing nice to say to these people.

[thedarb]

No. And you should be hung for treason for pushing for it. As should anyone in office pushing for it. You are conspiring against the people of the United States and should just be convicted of treason, and hung for it. Publicly. Put me on the jury, I'd vote to convict you. I'm sure there are a lot of us who'd vote to convict you. Just leave us alone.

Phone tapping the old fashioned way

[Prien715]

Back before the days of cell phones, judges could give prosecutors the ability to (1) break into someone's house, (2) install a device like these and then collect data.

You could also take someone's smart phone, root it, and install a surveillance software (with the same due process above). Even with encryption, if I have access to your phone (and it's unlocked -- figuring out a 6 key pass-code by spying isn't exactly James Bond's hardest mission) I would have access to your private key to decrypt said messages.

What law enforcement wants here are not the old rights they've always had -- but new ones. As the late Antonin Scalia wrote for the unanimous court regarding the unconstitutionality of planting a GPS device without a warrant:
“What we apply is an 18th century guarantee against unreasonable searches, which we believe must provide at a minimum the degree of protection it afforded when it was adopted,”

NOT a very binary issue, in their minds

[Anonymous Coward]

There's a variant of your #2:

2a. Companies are compelled to sell devices with reduced security because a master key lives somewhere.

The spooks are convinced that the master key can be kept secure. Maybe because they have it and give out keys generated from that to companies that provide crypto.

Sure, one day some hackers may gain that key and crack the world, but in the mean time, the FBI would be able to trivially crack all comms and they would be fine with that.

That's more or less what they are pushing for. I expect them to get it, more or less. I.e. every official app will be FBI approved and monitored, just like China. All unofficial crypto banned, just like China.

And, yes, only the outlaws will then have proper crypto. All honest civilians would be totally exposed to corrupt officials. Happy days.

Re:NOT a very binary issue, in their minds

[Anne Thwacks]

The spooks are convinced that the master key can be kept secure.

In the UK, that "secure place" is a laptop left in a taxi or pub, somewhere in London.
In the US, it is a mainframe with the root password set to "password".

You want true compromise?

[Anonymous Coward]

You want all our data? Fine, give us all YOUR data as well. 6 month lag at most to prevent issues of current investigations. Everything must be public, even access times, who and how much.

That's true compromise.

stupid fucks

[Hugh Jorgen]

cannot stop attacks that are reported prior, much less use data to do it. time to take up arms?

Appeasement? That's your solution?

[Anonymous Coward]

And then what do you propose when this "solution" later becomes not enough for them and they want more, and they alter the agreement, Mr. Chamberlain? And they WILL eventually want more. If you think not, you are the stupidest motherfucker to walk this earth.

Re: Appeasement? That's your solution?

[Anonymous Coward]

^He's right you know. The dragnet was supposed to be encrypted with escrow keys but the scrapped the protection and started sucking up data with a heavy whoosing sound from the stelar wind

Tough...

[Anonymous Coward]

...shit

Trump

[Anonymous Coward]

Someone should quietly point out to Trump that all those secret messages to Putin wouldn't be so secret if the FBI had their way regarding encryption. Things would quickly be resolved in favour of encryption then. ;)

Government solutions are low-intellect / pure forc

[Anonymous Coward]

"If it doesn't go the way I want, I will pass a law to kill those who defy my edicts."

The refrain of the politician.

What exactly does Wray think is going to happen here? Will he outlaw math?

Re: Haha!

[Anonymous Coward]

You're delusional if you think this is a Trump issue. Last I checked, Snowden happened under Obama.

Manufacturers

[Anonymous Coward]

The manufacturers have signing keys. They choose to show contempt of the courts in the US in a PR stint but kowtow to the Chinese.

Re: Manufacturers

[Anonymous Coward]

Signing keys are of no use of you can't unlock the device to install software.

Re:Manufacturers

[gl4ss]

the signing keys are only helpful for hacking phones that are already connected to a network and fetching updates.

and that's not what this is about anyways, this is about government wanting you to have encryption on your phone that is flawed by design, nothing more. if 10000 departments in usa would have boxes to decrypt your phones.. well, you might just as well not encrypt your phone in the first place since people who steal phones would also have those boxes.

sure would make stealing phones more profitable.

Re:Haha!

[Anonymous Coward]

All the FBI heads have said this, regardless of who appointed them.

Look at it like a safe

[DeAxes]

I still like the Safe Metaphor - the safe manufactures don't give backdoor codes to law enforcement. Instead, you have people in law enforcement learning how to crack the safe. What needs to happen is either law enforcement learns password cracking tools and the like, or more likely to have a separate branch, that specializes in password and phone cracking, which each law enforcement, from local to FBI, can send the items to with the corresponding warrant.

Not the Democrats

[rsilvergun]

oh wait, I guess it still counts if you're the one capitulating...

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Oh Genie

[Anonymous Coward]

You can't put the genie back in the bottle. Encryption is available to all in software. Legislation can't change that.

Already failed

[joe_frisch]

Any claims by the government that they can keep their hacking tools / backdoors secure were disproved by the Snowden data theft. Whatever the excuse, someone was able to steal extremely sensitive data from the NSA. Is there any real reason to think that other intelligence or law enforcement agencies would do a better job? So any tools the government has are likely to end up in the hands of other (possibly enemy) governments, and in the hands of organized crime.

The government has lost its credibility on this for a very long time.

So no, I do not believe the world will be a better place when no American's information is secure.

In addition, even if the government could be trusted to secure the information, I do not want to give them the power that that information represents. Governments can go bad, and open access to everyone secrets in the country is not a weapon that I trust in anyone's hands. I accept that the result of this is a higher rate of ordinary crime and terrorism. As things sit in the US now, that is a bargain that I am happy to accept.

alley CAPTCHA: overseer

[Anonymous Coward]

When he says "legislation" he means "martial law". Trump, are you listening?

Re:Shithole Cuntry Politicians Maybe

[Anonymous Coward]

You'd have to live in a real shithole cuntry to have politicians who serve only themselves. BIGLY what is your government transparency rating, or do you not even know?

in the past they could *bug* phones

[Anonymous Coward]

It isn't a given anymore as people even at home use a smartphone, something they always have on them and is nigh impossible to bug remotely, if it is a burner. So encryption *is* indeed an incredible privacy advance to what we had before, but it also enable perfectly private communication among criminal elements. And THAT did not exists before.

Re:in the past they could *bug* phones

[Anonymous Coward]

? There are a few phones that offer end-to-end encryption. Both sides would need to be using the same one. This is as it has always been. Scramblers have been around forever for those with the kind of money that is required to purchase a really good secure cell phone.

There are also apps that do it. That would be the better bet. Routed properly, you could even hide who you're talking to that way. That information is often as important as the content of the discussion.

For us regular folks, they don't even need to go to your home to bug your phone. They can just exercise their warrant at the telco. It's all electronic. Why do you think burners are so necessary?

Even with a burner, have you never heard of an IMSI catcher? You can build one for a couple thousand and intercept most calls if you can get within a few hundred feet. Then you don't need to know the phone's details. You can just tap everything in the immediate area.

Pandora is already out of her box

[Anonymous Coward]

Strong encryption already exists and the best you can hope to do via legislation is create a black market for it. Considering what an abject failure the war on drugs has been it is safe to say that the war on encryption will encounter similar pitfalls.

Flat Earthers Deserve Less Credit Than You Give

[cervesaebraciator]

I agree with the thrust of your post, but a detail compels me to offer a friendly correction.

A still very instructive example of that is when the catholic church tried to force the world to be flat. They had absolutely no understanding that the shape of the planet [...]

This is untrue. Scholars in the middle ages were mistaken about many aspects of cosmology, to be sure, but the whole flat Earth business is a myth in more ways than one. First, it's important to understand that there were no official dogmas on these matters. But setting that fact aside (which requires a discussion of how dogma, canons, and councils work), there's a more directly relevant fact. The major Christian teachers during the middle ages treated the world as spherical. Hell, even the guys who objected to Galileo in later years thought of the world as spherical.

The reasons for this have to with the Aristotelian physics to which the objectors to Galileo were regrettably too committed. To oversimplify their position: earth (dirt, minerals, etc.) and water goes down; air and fire go up. If the former go down from all directions and the latter go up, you cannot but have a spherical planet with airy, firey (and quintessential!) things above it. Indeed, the objection to Galileo is based partly on this Aristotelian understanding of the elements (How can the Earth be moving in a circular fashion if the natural motion of its primary constituent--earth--is simply down?). To be sure, we have a better understanding of physics today than did the scholastic disciples of Aristotle, but I hope you can see that even in their view a flat Earth is incoherent.

TL;DR: Neither the Church nor educated medieval folk in general bought into any flat Earth nonsense. This is merely a popular myth. Modern flat Earthers are even behind Aristotle (d. 322 B.C.) on this one. Now, whether the spherical Earth was thought of as moving or fixed in the center of the universe is another story altogether...

P.s. I only offer this lengthy correction because sometimes I fear we give modern flat Earthers the appearance of having even more credit than they deserve. Conspiratorial minds can dismiss claims of what we can discover with government funded rockets and satellites. "No one believed this round earth stuff until the government forced it on us all and fabricated the evidence!" My response is something along the lines of, "Come on. Medieval people knew the Earth was round. Eratosthenes had a pretty good estimation of its size, given the limited tools he was working with. Come join the third century B.C., will you? Grab a pocket calculator and look down a well."

Re:Flat Earthers Deserve Less Credit Than You Give

[Anonymous Coward]

The Church said the center of the universe was the Earth, which led to the whole Galileo/heretic bit. A disagreement about the location, not the shape. Flat earth has nothing to do with the Church. He's probably thinking that all those Flat Earth people do indeed seem like they would be church-going types (and they certainly are) ... therefore "Christian"... and therefore..."Flat Earth = Church"

Except those people are Protestant.

Re:Flat Earthers Deserve Less Credit Than You Give

[fafalone]

"Were you there to hear Eratowhatever say that? No. That's just more false history the gubmint puts out there to back up its propaganda." -Flat earther

Come on, you know there's no getting through to people like that.

Re:Flat Earthers Deserve Less Credit Than You Give

[gweihir]

For the purpose at hand, it really does not matter whether they though the earth was flat or whether it was the center of the universe.

Re:Flat Earthers Deserve Less Credit Than You Give

[Anonymous Coward]

Thanks to some insights in your response I went down a rabbit hole reading about Aryabhata. That guy was amazing. by 500 CE the dude had figured out stuff europe had taken thousands of years to prove (like the irrationality of pi, etc.)

So let's remedy it with legislation, then

[Anonymous Coward]

DMCA has an exemption for law enforcement. Remove that.

Yes, People are less safe.

[Anonymous Coward]

More like the government institutions are less safe from the people.

People are less safe. Incompetently planned terrorist attacks are more likely to succeed. Criminals are more likely to go uncaught.

But we are also more secure against massive casual surveillance, and have more of a buffer against a worse government than the one we have now. The problem with most of these things aren't what the government is doing with them, it's (mostly) what the government *could* do with them if the culture of certain three letter agencies got worse.

Required for a law abiding society

[Anonymous Coward]

The government has the right to intercept your communication when you're a subject of investigation for a crime. In that situation the law says that the police or relevant authority CAN listen in to what you're saying because a judge authorised it. When a warrant has been issued by a judge for the interception of a person's communications then any conversation they have using telecommunications devices is up for grabs by the police, etc. This also applies to surveillence and bugging environments/people so that they can be eavesdropped on - when authorized.

The problem is that people want to believe that because they use WhatsApp encrypted chat that somehow that communication is not covered by the warrant issued by a judge.

Of course feel free to add on here that the government should never be able to issue a wiretap order or similar to gain evidence in a case of investigating criminal behaviour because acquiring evidence of crmininal behaviour is not what we want the police to be able to do, right?

Re:Required for a law abiding society

[gerald.edward.butler]

Yes, but the government doesn't have the right to say you must use the telephone so that they can easily intercept your conversation when they want. You get to choose how you communicate. If you choose a method that is interceptable, then the government can, with warrant, intercept it. The government doesn't have the right to tell you you have to use an interceptable communication medium.

you think i use consumer grade crypto?

[Anonymous Coward]

Well that was your first mistake

Go die in a fire you piece of shit

Wot?

[Anonymous Coward]

Don't you have orange traitors to chase who is too stupid to use encryption?

People are also less safe because of these things:

[johannesg]

- Unlimited immigration.
- Letting crime run rampant without any attempt at enforcement or punishment.
- Running grand social experiments on the population.
- Raising tensions with Russia.
- General war-mongering.
- Elites fighting among each other with no regard for actually taking care of the country.

Encryption actually ranks pretty low on the list of things that keep people unsafe.

It's called the USA PATRIOT act.

[Anonymous Coward]

Yes, itnis actually called literally that. And it says basically exactl what you said.

How quickly people forget.

Yes, cording to that law, they can just grab you, ship you to some conecntration camp, I mean black site (like Guantanamo), and you do not even have the right to ask why, let alone contact anyone (even a lawyer or your family).

Yes, the US de-facto is a full-on totalitarian fascist state. Theivestock, err, people just haven't realized yet. Just like here in Germany back in the days. (People said they did not know what was going on at Auschwitz etc.)

NOT your choice! That's the point!

[Anonymous Coward]

Jesus, how voter (aka retarded) are you??

Just like you cannot choose to hear something. Or more sneakily, could not *actually* choose not to read *this*!

Somebody can and will send you encrypted data to get rid of you. Or do you believe you have no enemies? (Not with being an asshat like that!)

Re:NOT your choice! That's the point!

[Shotgun]

Can't really tell, AC, but you seem to be upset that this complication could occur. You see, the thing is, Christopher Wray isn't. If they are trying to hang something on you, you go to jail. If you are part of their club, you're as free as Hillary.

It goes back to that monologue out of "Atlas Shrugged". Laws aren't made to enforce justice. They're made to entrap. We're all guilty of something if somebody like Mueller wants to push it. This is just a law that will make pushing easier for those that consider themselves better than the rest of us.

The entire definition of profit is...

[Anonymous Coward]

... that it is the money NOT earned and NOT worked for.

Aka the money STOLEN or ROBBED.

And that is the entire basis of your capitalism.

Communism is a stupid delusional idea, ignorant of human behavior, that can never work in practice.

Capitalism is literally crime, and stems from a psychopath mindset where harm to others is not only OK, but MUST be growing exponentially, or it's stagnation/depression and oh noes!

And if you treat this like a dichotomy, then you are passive-thinking programmed livestock already.

Wouldn't want private conversations in the open...

[giggleloop]

"I don't want to characterize private conversations we're having with people in the industry. " Somebody missed Irony 101 at the academy...

Safer?

[shaitand]

Unless you are dumb enough to both be poor AND live in a major metro area (seriously, greyhound can solve that for $50 so you have it coming) the biggest threats when it comes to crime are circumstances and paranoid law enforcement.

Pi=3

[Anonymous Coward]

Maybe legislation should settle Pi while they're at it. Seems about as productive.

if the NRA actually cared about the 2nd amendment

[Anonymous Coward]

They would be at the forefront of this debate. It is unquestionably true that encryption is an "arm" used for self defense. It is in fact one arm that has no offensive use at all and can be used only to defend yourself from attack.

Panopticons for everyone!!!!!!

[EricTDuckman1414]

He claims opaque walls and doors keep law enforcement from gaining access to key evidence as it relates to active criminal investigations. "People are less safe as a result of it," he said.

Panopticons for everyone!!!!!!

POTUS appointed stooge

[Anonymous Coward]

POTUS fired the sitting FBI director and appointed this stooge. What did you expect? He did not need to have experience in the field. It was meant to punish the FBI. Again, what did you expect?

typical response

[Anonymous Coward]

from a non technical guy talking about technical issues, his idea is to mandate a non technical solution to a technical problem.

He is pissed because American companies wont do his bidding of unlocking phones whenever he wants. Meanwhile what these companies see is the economy slowing down because people WILL stop using cellphones. First they will be banned from any corporate office as a matter of corporate policy, Now you have people using their phones less and starting to create social groups again, making plans, doing stuff, Shopping less! There goes ad revenues for google and sales for amazon, most of the advertisers will start going out of business, media companies will start having to cut back.. Hell, people will actually have to start having civilized conversations face to face. OOh dont forget the banks and investment firms, who is going to invest money in a company where workers bring compromised devices into the building every day?

I believe in the FBI director and support his short sighted plan to remove encryption! He may be a tool but he could single handedly kill the control that big businesses and the government have over our lives.

There's already room for compromise

[Rastl]

His statement that there's room for compromise is correct. The compromise is that law enforcement accepts that default encryption is in place, it's going to keep getting better, and they're not going to get to dictate or legislate anything about it.

The lame "it makes it harder to do our jobs" doesn't fly. The numbers are against them. The total number of people using devices with default encryption vs the number of devices they want to encrypt makes their sample statistically insignificant.

People want secure encryption. Not "secure except for anyone who has the keys to decrypt it under dubious circumstances" encryption. Companies know that and they're going with what their customers want.

There's an entire division of government dedicated to doing things like breaking encryption. Let them earn their paychecks by working on ways to break encryption. If they can't then that's not the consumer's problem.

Demanding less secure encryption is a slippery slope. If they can force it to happen then they've got precedent for other kinds of default access. Key locks? Need a master key for those so we can enter without constraint. Vehicles? Master key. Email? Master key/default access.

You can't give up one kind of security without putting every other one at risk.

Re:dd if=/dev/random of=/storage/2468-5569/Andriod

[drinkypoo]

Willful destruction of evidence is a crime if you do it because you think you might be prosecuted for it. It will save your secret plans to rule the world, but it won't save you from prison.

Luddites

[Anonymous Coward]

Without a proper means to protect my data from government intrusion, we will just go without. I'll cancel all of our email, cell phone, and other services and stick to farming. There's something to be said for living a simple life. We live on 100 acres in the middle of nowhere already, and we already grow about half the food that we need (we don't have livestock so we buy all of our dairy and meat products).

Fourth Amendment

[Anonymous Coward]

"People are less safe as a result of it,"

Dude

[Anonymous Coward]

It's always amazing to see the ignorance of such prominent figures put on public display like this. You would think that they'd be unwilling to play the part of a fool for so long and without apparent embarrassment or hesitation. They know damn well you can't have a backdoor without the keys falling into the wrong hands eventually. Even so, they seem ignorant of the fact that most of the public wants to hide their everyday communications from the government, and nobody's to blame for that but the government abusing their powers. In the days of old nobody cared if the FBI or police accidentally picked up some of their phone call while legitimately tapping a criminal's phone (for example). But once the government decided to engage in wholesale surveillance people reacted. Too bad, so sad assholes. You can't put the genie back in the bottle.

Re:Dude

[EmagGeek]

Don't mistake malicious intent for ignorance...

It won't be like that.

[Anonymous Coward]

It won't be like that.

All they need to do is pass the equivalent of CALEA for chat apps.

It isn't the FBI's problem how companies comply with that kind of law, only that they do.

Or the law will say that phone manufacturers must be able to unlock a phone and provide it to the FBI for access to text messages, etc, when given a subpoena from a judge. The FBI won't care about the mechanics, that's the problem for some geeks in Silicon Valley.

And when they don't some executive level goes to jail or pays $millions in fines.

The FBI doesn't care who has the keys, only that they can access encrypted communications using devices provided to American citizens by American companies.

The Trump FBI

[Anonymous Coward]

Wants this so the Russians can get into anything.

The "good guys" are the problem

[Anonymous Coward]

We actually need strong encryption to protect us from the "good guys".

Law enforcement competence

[scarboni888]

How in the world did law enforcement manage to do their jobs BEFORE they had massive amounts of metadata to drink from?

And now they say they need the data too because without it we're not safe. So they're saying they were completely unable to execute law enforcement duties BEFORE the ability to massively spy on everyone became possible? How in the world did they EVER manage to catch any criminals?

Horse shit. Completely & utter horse shit.

*Expletive* No.

[Anonymous Coward]

Nahah.

Slashdot Consensus

[bobbutts]

Nice to see we still all agree on something.

Compromise

[Thad Boyd]

There are may situations where compromise is possible. (Maybe not likely in our current political climate, but technically possible.)

This is not one of them. This is a binary choice. Encryption is secure or it isn't. It works or it doesn't. It keeps the "good guys" out or it lets the "bad guys" in. Because computers are not magic and cannot tell the difference between a good guy and a bad guy.

Those are facts. A phone that is secure except to US government representatives following due process is a fantasy. You can ask for a compromise between facts and fantasy all you want, but you're not going to get one.

Dammit, you took my serious post...

[alispguru]

... and did the satirical version!

Publishing source code for how to encrypt securely is First Amendment protected free speech - this was settled in the Pretty Good Privacy case in the 1990's. Phillip Zimmerman put the source for PGP in a dead-tree book, to make absolutely sure the First Amendment would be cited.

So, actually we have a constitutional right to see how to communicate securely.

âoeLess safeâ

[Anonymous Coward]

The three-letter agencies had a brief taste of information supremacy after the idiotic Patriot Act was passed in a rush. Them America found out that these agencies were illegally spying on us, and blatantly lying about it. Now they want to go back to the awesome days when they knew everything and nothing was encrypted. F that

Compromise

[Shotgun]

How about this for a compromise: I give up my right to keep my conversations to myself, while everyone in Congress, along with all upper administrative personnel in the government are forced to wear body cameras.

There Are Already Laws

[jdschulteis]

We already have relevant laws:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

The Fourth Amendment prohibits legislation that forbids people from keeping their "papers and effects" encrypted when no warrant has been issued. When a warrant has been issued:

nor shall any person [...] be compelled in any criminal case to be a witness against himself

The Fifth Amendment forbids compelling anyone to provide self-incriminating testimony, why should compelling anyone to provide self-incriminating evidence be any different?

Mandating key escrow might be constitutional. Then they could convict for the crime of having an un-escrowed encrypted device even if they couldn't prove terrorism or pedo charges. Remember, Al Capone was convicted of tax evasion, not murder or racketeering.

We'll take it

[Anonymous Coward]

Why does Wray think that he can get whatever legislation he wants? Yes, there is a history of legislators siding with law enforcement, but it is definitely not a lock.

Wait....

[Anonymous Coward]

So the FBI is a legislating body now?

I thought that was the supreme court. /sarc

They can have my

[Contract Gypsy]

data when they pry my Palm device from my cold dead hand!

Re:Privacy is great in theory

[currently_awake]

Everything the government needed to stop 9/11 was in a government database prior to the attacks. But nobody saw the evidence because the American intelligence agencies are burried under so much data they can't process it.

Public Key Encryption for Dummies

[Anonymous Coward]

Public Key Encryption can not be adjusted for a back door. So Wray is asking that it not be used. And if that is then done...Hackers rejoice!!! Our leaders are idiots who did not study any advanced technical courses. Wray must study a Number Theory book before opening is blabbering mouth.

Timing is everything

[eric_harris_76]

Good thing the opaque envelope was invented before the FBI was created, or they'd be furiously working to get it banned, too.

Can't have criminals and terrorists and -- Think of the children! -- child pornographers and such communicating undetected.

Re:dd if=/dev/random of=/storage/2468-5569/Andriod

[Anonymous Coward]

Your honor, my client chose to generate random bytes and put them in 1 bunch of 1G files, neither of which is not a crime.
Those files do not now contain and never did contain anything to decrypt.

Remember 40-bit export-grade encryption?

[tepples]

You are correct that I haven't written the legislation. But the broad strokes of the case to support exempting uncommon spoken language from regulation of encryption is similar to the case for 40-bit "export-grade" encryption back in the 1990s.

Re:Privacy is great in theory

[Sique]

Hindsight is always 20/20. What we don't know is how many flawed entries would have been in a more complete database. Now that all dots are connected we know which ones were part of the pictures, and which ones were just specks of dust and fly spots.

Just because you have your data pre-sorted doesn't make it any more correct.

Re:Privacy is great in theory

[Anonymous Coward]

> nobody cares
wow, you actually think the modern privacy rape is being carried out by _humans_? maybe sitting in a dark camera-array room hidden away somewhere? an army of them, of course, toiling away in the millions - if only there was a better way~

> key escrow can prevent
the only question here is if you're getting your 50 cents or just spreading misinformation for free

Because "Orgy of computation"

[Bob the Super Hamste]

I never said a 3DES approach was great only that if someone wanted to roll their own for increased security taking that approach with an existing cipher would be the best option. I did address the key schedule issue when just increasing the rounds as I did state that they would have to generate additional round keys. Cascading ciphers is already used by some tools, see old TrueCrypt or VeraCrypt, but there you are still dependent on a single password.
I didn't make any statements on the feasibility of actually breaking AES. I believe that currently the estimate to break AES128 on an ideal classical computer using the best methods available puts the energy requirements at about 10% of the total annual US energy consumption. If one assumes that there exists an ideal quantum computer that can handle it then AES256 would have the same energy requirement, if not then AES256 has the energy requirement on the order of the mass energy of our sun on an ideal classical computer. This type of discussion is always a fun one because one can always bring up Bruce Schneier's "orgy of computation" statement which is probably one of my favorite ones of all time.

"remedy"

[Anonymous Coward]

They've already got an essentially unlimited access to all moving data...Why would anyone grant them more power and diminish the rights of the citizen more?